@andrewheberle/serverless-ssh-ca 0.23.0 → 0.24.1

package/dist/ssh/keys.js

@@ -103,6 +103,34 @@ export class PublicKey {
         return this.comment === undefined ? key : `${key} ${this.comment}`;
     }
 }
+/**
+ * The smallest RSA key, in bits, that the CA will issue a certificate for.
+ * This matches the minimum accepted by ssh-ca-client.
+ */
+export const MinimumRsaKeyBits = 2048;
+/**
+ * Returns the size in bits of the modulus of an RSA public key, or undefined
+ * if the key is not an RSA key.
+ *
+ * @param key The public key
+ */
+export const rsaKeyBits = (key) => {
+    if (key.type !== "ssh-rsa") {
+        return undefined;
+    }
+    // the fields of an RSA key are the exponent and the modulus, an mpint
+    // that may have a leading zero byte to keep it positive
+    const modulus = decodePublicKey(key.blob).fields[1];
+    if (modulus === undefined) {
+        return undefined;
+    }
+    const start = modulus.findIndex((byte) => byte !== 0);
+    const first = modulus[start];
+    if (start === -1 || first === undefined) {
+        return 0;
+    }
+    return (modulus.length - start - 1) * 8 + first.toString(2).length;
+};
 const EcdsaCurves = {
     nistp256: { namedCurve: "P-256", size: 32 },
     nistp384: { namedCurve: "P-384", size: 48 },
@@ -150,23 +178,86 @@ const EcdsaPrivateKey = P.struct({
 const keyTypeName = (type) => {
     return type.replace(/^ssh-/, "").replace(/^ecdsa-sha2-.*$/, "ecdsa");
 };
+// decodes the base64 body of a PEM block
+const decodePem = (body) => {
+    try {
+        return new Uint8Array(base64.decode(body.replace(/\s+/g, "")));
+    }
+    catch (err) {
+        throw new KeyParseError("private key could not be decoded", err);
+    }
+};
+/** The algorithms that an unencrypted PKCS#8 private key is imported as, in the order they are tried */
+const Pkcs8Algorithms = [
+    { type: "ed25519", algorithm: { name: "Ed25519" } },
+    ...["nistp256", "nistp384", "nistp521"].map((curve) => ({ type: "ecdsa", curve, algorithm: { name: "ECDSA", namedCurve: EcdsaCurves[curve].namedCurve } })),
+];
+// imports a PKCS#8 private key, returning undefined if it is not a key for
+// the algorithm
+const importPkcs8 = async (der, algorithm) => {
+    try {
+        return await crypto.subtle.importKey("pkcs8", der, algorithm, true, ["sign"]);
+    }
+    catch {
+        return undefined;
+    }
+};
+// returns a member of a JWK exported by WebCrypto, which is always present
+// for the key types that are exported
+const jwkMember = (jwk, name) => {
+    const value = jwk[name];
+    if (value === undefined) {
+        throw new KeyParseError(`private key was missing "${name}" when exported`);
+    }
+    return value;
+};
+/**
+ * Parses an unencrypted Ed25519 or ECDSA private key in PKCS#8 format, as
+ * created by `ssh-keygen -m PKCS8` or `openssl genpkey`
+ */
+const parsePkcs8PrivateKey = async (body) => {
+    const der = decodePem(body);
+    for (const candidate of Pkcs8Algorithms) {
+        const cryptoKey = await importPkcs8(der, candidate.algorithm);
+        if (cryptoKey === undefined) {
+            continue;
+        }
+        const jwk = await crypto.subtle.exportKey("jwk", cryptoKey);
+        const d = jwkMember(jwk, "d");
+        const x = jwkMember(jwk, "x");
+        if (candidate.type === "ed25519") {
+            return {
+                type: "ed25519",
+                publicKey: new PublicKey(P.struct({ type: SSHText, key: SSHBytes }).encode({ type: "ssh-ed25519", key: base64urlnopad.decode(x) })),
+                jwk: { kty: "OKP", crv: "Ed25519", d, x },
+            };
+        }
+        const y = jwkMember(jwk, "y");
+        const point = new Uint8Array([0x04, ...base64urlnopad.decode(x), ...base64urlnopad.decode(y)]);
+        return {
+            type: "ecdsa",
+            curve: candidate.curve,
+            publicKey: new PublicKey(P.struct({ type: SSHText, curve: SSHText, key: SSHBytes }).encode({ type: `ecdsa-sha2-${candidate.curve}`, curve: candidate.curve, key: point })),
+            jwk: { kty: "EC", crv: EcdsaCurves[candidate.curve].namedCurve, d, x, y },
+        };
+    }
+    // RSA keys are recognised only to give a clearer error
+    if (await importPkcs8(der, { name: "RSASSA-PKCS1-v1_5", hash: "SHA-256" }) !== undefined) {
+        throw new UnsupportedKeyError("CA key type rsa is not supported, the CA key must be Ed25519 or ECDSA");
+    }
+    // WebCrypto does not say why a key could not be imported, so a key of
+    // another type cannot be told apart from one that is corrupt
+    throw new KeyParseError("PKCS#8 private key could not be imported as an Ed25519 or ECDSA (nistp256, nistp384 or nistp521) key");
+};
 /**
  * Parses an unencrypted Ed25519 or ECDSA private key in OpenSSH format, as
  * created by `ssh-keygen`
- *
- * @param text The private key, starting with `-----BEGIN OPENSSH PRIVATE KEY-----`
- * @returns The private key
- * @throws {@link KeyParseError} when the key cannot be parsed or is encrypted
- * @throws {@link UnsupportedKeyError} when the key is not an Ed25519 or ECDSA key
  */
-export const parsePrivateKey = (text) => {
-    const match = /-----BEGIN OPENSSH PRIVATE KEY-----([\s\S]*?)-----END OPENSSH PRIVATE KEY-----/.exec(text);
-    if (match === null) {
-        throw new KeyParseError("private key was not in OpenSSH format, as created by ssh-keygen (starting with -----BEGIN OPENSSH PRIVATE KEY-----)");
-    }
+const parseOpenSshPrivateKey = (body) => {
+    const bytes = decodePem(body);
     let container;
     try {
-        container = OpenSshPrivateKey.decode(base64.decode(match[1].replace(/\s+/g, "")));
+        container = OpenSshPrivateKey.decode(bytes);
     }
     catch (err) {
         throw new KeyParseError("private key could not be decoded", err);
@@ -246,4 +337,28 @@ export const parsePrivateKey = (text) => {
     }
     throw new UnsupportedKeyError(`CA key type ${keyTypeName(start.type)} is not supported, the CA key must be Ed25519 or ECDSA`);
 };
+/**
+ * Parses an unencrypted Ed25519 or ECDSA private key, either in OpenSSH
+ * format, as created by `ssh-keygen`, or in PKCS#8 format, as created by
+ * `ssh-keygen -m PKCS8` or `openssl genpkey`
+ *
+ * @param text The private key, starting with `-----BEGIN OPENSSH PRIVATE KEY-----` or `-----BEGIN PRIVATE KEY-----`
+ * @returns The private key. A PKCS#8 key has no comment.
+ * @throws {@link KeyParseError} when the key cannot be parsed or is encrypted
+ * @throws {@link UnsupportedKeyError} when the key is not an Ed25519 or ECDSA key
+ */
+export const parsePrivateKey = async (text) => {
+    const openssh = /-----BEGIN OPENSSH PRIVATE KEY-----([\s\S]*?)-----END OPENSSH PRIVATE KEY-----/.exec(text);
+    if (openssh?.[1] !== undefined) {
+        return parseOpenSshPrivateKey(openssh[1]);
+    }
+    const pkcs8 = /-----BEGIN PRIVATE KEY-----([\s\S]*?)-----END PRIVATE KEY-----/.exec(text);
+    if (pkcs8?.[1] !== undefined) {
+        return parsePkcs8PrivateKey(pkcs8[1]);
+    }
+    if (text.includes("-----BEGIN ENCRYPTED PRIVATE KEY-----")) {
+        throw new KeyParseError("encrypted private keys are not supported");
+    }
+    throw new KeyParseError("private key was not in OpenSSH format, as created by ssh-keygen (starting with -----BEGIN OPENSSH PRIVATE KEY-----), or in PKCS#8 format (starting with -----BEGIN PRIVATE KEY-----)");
+};
 //# sourceMappingURL=keys.js.map

package/dist/ssh/keys.js.map

@@ -1 +1 @@
-{"version":3,"file":"keys.js","sourceRoot":"","sources":["../../src/ssh/keys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAA;AAC9C,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AACjE,OAAO,KAAK,CAAC,MAAM,cAAc,CAAA;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAA;AACtD,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,eAAe,CAAA;AAElE;;GAEG;AACH,MAAM,OAAO,aAAc,SAAQ,KAAK;IACvC,YAAY,OAAe,EAAE,KAAe;QAC3C,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,eAAe,CAAA;QAC3B,IAAI,CAAC,KAAK,GAAG,KAAK,CAAA;QAElB,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,aAAa,CAAC,SAAS,CAAC,CAAA;IACrD,CAAC;CACD;AAED;;GAEG;AACH,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAC7C,YAAY,OAAe;QAC1B,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAA;QAEjC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,mBAAmB,CAAC,SAAS,CAAC,CAAA;IAC3D,CAAC;CACD;AAED,MAAM,UAAU,GAAG,CAAC,CAAa,EAAE,CAAa,EAAW,EAAE;IAC5D,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;AAC9D,CAAC,CAAA;AAED;;GAEG;AACH,MAAM,OAAO,SAAS;IACrB,8CAA8C;IACrC,IAAI,CAAQ;IACrB,0DAA0D;IACjD,IAAI,CAAY;IACzB,qCAAqC;IAC5B,OAAO,CAAoB;IAEpC;;;;OAIG;IACH,YAAY,IAAgB,EAAE,OAAgB;QAC7C,IAAI,CAAC;YACJ,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,IAAI,CAAA;QACvC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,MAAM,IAAI,aAAa,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,iCAAiC,EAAE,GAAG,CAAC,CAAA;QACrG,CAAC;QACD,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;QAChB,IAAI,CAAC,OAAO,GAAG,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAA;IACpD,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,KAAK,CAAC,IAAY;QACxB,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;QACzD,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YAC7D,MAAM,IAAI,aAAa,CAAC,sCAAsC,CAAC,CAAA;QAChE,CAAC;QAED,IAAI,IAAgB,CAAA;QACpB,IAAI,CAAC;YACJ,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;QAC3B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,MAAM,IAAI,aAAa,CAAC,iCAAiC,EAAE,GAAG,CAAC,CAAA;QAChE,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;QAClD,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACvB,MAAM,IAAI,aAAa,CAAC,mBAAmB,IAAI,+BAA+B,GAAG,CAAC,IAAI,EAAE,CAAC,CAAA;QAC1F,CAAC;QAED,OAAO,GAAG,CAAA;IACX,CAAC;IAED;;;OAGG;IACH,WAAW;QACV,OAAO,UAAU,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAA;IACzD,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,KAAgB;QACtB,OAAO,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAA;IACzC,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,OAA2B;QACtC,OAAO,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IACzC,CAAC;IAED;;OAEG;IACH,QAAQ;QACP,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAA;QAEtD,OAAO,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,IAAI,CAAC,OAAO,EAAE,CAAA;IACnE,CAAC;CACD;AAKD,MAAM,WAAW,GAAuE;IACvF,QAAQ,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE;IAC3C,QAAQ,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE;IAC3C,QAAQ,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE;CAC3C,CAAA;AAiBD,qBAAqB;AACrB,MAAM,UAAU,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAA;AAE/D,6DAA6D;AAC7D,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,KAAK,EAAE,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC;IAC/B,UAAU,EAAE,OAAO;IACnB,OAAO,EAAE,OAAO;IAChB,UAAU,EAAE,QAAQ;IACpB,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,QAAQ,CAAC;IACtC,WAAW,EAAE,QAAQ;CACrB,CAAC,CAAA;AAEF,6EAA6E;AAC7E,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,MAAM,EAAE,CAAC,CAAC,KAAK;IACf,MAAM,EAAE,CAAC,CAAC,KAAK;IACf,IAAI,EAAE,OAAO;CACb,CAAC,CAAA;AAEF,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,MAAM,EAAE,CAAC,CAAC,KAAK;IACf,MAAM,EAAE,CAAC,CAAC,KAAK;IACf,IAAI,EAAE,OAAO;IACb,SAAS,EAAE,QAAQ;IACnB,sCAAsC;IACtC,UAAU,EAAE,QAAQ;IACpB,OAAO,EAAE,OAAO;CAChB,CAAC,CAAA;AAEF,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,MAAM,EAAE,CAAC,CAAC,KAAK;IACf,MAAM,EAAE,CAAC,CAAC,KAAK;IACf,IAAI,EAAE,OAAO;IACb,KAAK,EAAE,OAAO;IACd,SAAS,EAAE,QAAQ;IACnB,WAAW;IACX,UAAU,EAAE,QAAQ;IACpB,OAAO,EAAE,OAAO;CAChB,CAAC,CAAA;AAEF;;GAEG;AACH,MAAM,WAAW,GAAG,CAAC,IAAY,EAAU,EAAE;IAC5C,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAA;AACrE,CAAC,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,IAAY,EAAc,EAAE;IAC3D,MAAM,KAAK,GAAG,gFAAgF,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACzG,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACpB,MAAM,IAAI,aAAa,CAAC,qHAAqH,CAAC,CAAA;IAC/I,CAAC;IAED,IAAI,SAAkD,CAAA;IACtD,IAAI,CAAC;QACJ,SAAS,GAAG,iBAAiB,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAA;IACnF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,MAAM,IAAI,aAAa,CAAC,kCAAkC,EAAE,GAAG,CAAC,CAAA;IACjE,CAAC;IAED,IAAI,SAAS,CAAC,UAAU,KAAK,MAAM,IAAI,SAAS,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC;QACrE,MAAM,IAAI,aAAa,CAAC,0CAA0C,CAAC,CAAA;IACpE,CAAC;IACD,IAAI,SAAS,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,aAAa,CAAC,yCAAyC,SAAS,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,CAAA;IAChG,CAAC;IAED,4EAA4E;IAC5E,MAAM,OAAO,GAAG,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAA;IAC1C,IAAI,KAAgD,CAAA;IACpD,IAAI,CAAC;QACJ,KAAK,GAAG,mBAAmB,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,EAAE,OAAO,CAAC,CAAA;IACnE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,MAAM,IAAI,aAAa,CAAC,kCAAkC,EAAE,GAAG,CAAC,CAAA;IACjE,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;QACnC,MAAM,IAAI,aAAa,CAAC,wCAAwC,CAAC,CAAA;IAClE,CAAC;IAED,IAAI,CAAC;QACJ,IAAI,KAAK,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;YAClC,MAAM,GAAG,GAAG,iBAAiB,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,EAAE,OAAO,CAAC,CAAA;YACpE,IAAI,GAAG,CAAC,SAAS,CAAC,MAAM,KAAK,EAAE,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;gBACjE,MAAM,IAAI,aAAa,CAAC,8CAA8C,CAAC,CAAA;YACxE,CAAC;YACD,MAAM,SAAS,GAAG,IAAI,SAAS,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAE,EAAE,GAAG,CAAC,OAAO,CAAC,CAAA;YACtE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC9H,MAAM,IAAI,aAAa,CAAC,0CAA0C,CAAC,CAAA;YACpE,CAAC;YAED,OAAO;gBACN,IAAI,EAAE,SAAS;gBACf,SAAS;gBACT,GAAG,EAAE;oBACJ,GAAG,EAAE,KAAK;oBACV,GAAG,EAAE,SAAS;oBACd,CAAC,EAAE,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBACxD,CAAC,EAAE,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC;iBACvC;aACD,CAAA;QACF,CAAC;QAED,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;YAC1C,MAAM,GAAG,GAAG,eAAe,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,EAAE,OAAO,CAAC,CAAA;YAClE,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,KAAmB,CAAC,CAAA;YAClD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC;gBACrE,MAAM,IAAI,mBAAmB,CAAC,eAAe,GAAG,CAAC,KAAK,mBAAmB,CAAC,CAAA;YAC3E,CAAC;YACD,IAAI,GAAG,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,GAAG,KAAK,CAAC,IAAI,GAAG,CAAC,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC9E,MAAM,IAAI,aAAa,CAAC,4CAA4C,GAAG,CAAC,KAAK,EAAE,CAAC,CAAA;YACjF,CAAC;YACD,MAAM,SAAS,GAAG,IAAI,SAAS,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAE,EAAE,GAAG,CAAC,OAAO,CAAC,CAAA;YACtE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;gBAChK,MAAM,IAAI,aAAa,CAAC,0CAA0C,CAAC,CAAA;YACpE,CAAC;YAED,OAAO;gBACN,IAAI,EAAE,OAAO;gBACb,KAAK,EAAE,GAAG,CAAC,KAAmB;gBAC9B,SAAS;gBACT,GAAG,EAAE;oBACJ,GAAG,EAAE,IAAI;oBACT,GAAG,EAAE,KAAK,CAAC,UAAU;oBACrB,6DAA6D;oBAC7D,CAAC,EAAE,cAAc,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;oBAClE,CAAC,EAAE,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;oBACnE,CAAC,EAAE,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;iBAChE;aACD,CAAA;QACF,CAAC;IACF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,IAAI,GAAG,YAAY,aAAa,IAAI,GAAG,YAAY,mBAAmB,EAAE,CAAC;YACxE,MAAM,GAAG,CAAA;QACV,CAAC;QACD,MAAM,IAAI,aAAa,CAAC,kCAAkC,EAAE,GAAG,CAAC,CAAA;IACjE,CAAC;IAED,MAAM,IAAI,mBAAmB,CAAC,eAAe,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,wDAAwD,CAAC,CAAA;AAC9H,CAAC,CAAA"}
+{"version":3,"file":"keys.js","sourceRoot":"","sources":["../../src/ssh/keys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAA;AAC9C,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AACjE,OAAO,KAAK,CAAC,MAAM,cAAc,CAAA;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAA;AACtD,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,eAAe,CAAA;AAElE;;GAEG;AACH,MAAM,OAAO,aAAc,SAAQ,KAAK;IACvC,YAAY,OAAe,EAAE,KAAe;QAC3C,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,eAAe,CAAA;QAC3B,IAAI,CAAC,KAAK,GAAG,KAAK,CAAA;QAElB,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,aAAa,CAAC,SAAS,CAAC,CAAA;IACrD,CAAC;CACD;AAED;;GAEG;AACH,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAC7C,YAAY,OAAe;QAC1B,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAA;QAEjC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,mBAAmB,CAAC,SAAS,CAAC,CAAA;IAC3D,CAAC;CACD;AAED,MAAM,UAAU,GAAG,CAAC,CAAa,EAAE,CAAa,EAAW,EAAE;IAC5D,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;AAC9D,CAAC,CAAA;AAED;;GAEG;AACH,MAAM,OAAO,SAAS;IACrB,8CAA8C;IACrC,IAAI,CAAQ;IACrB,0DAA0D;IACjD,IAAI,CAAY;IACzB,qCAAqC;IAC5B,OAAO,CAAoB;IAEpC;;;;OAIG;IACH,YAAY,IAAgB,EAAE,OAAgB;QAC7C,IAAI,CAAC;YACJ,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,IAAI,CAAA;QACvC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,MAAM,IAAI,aAAa,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,iCAAiC,EAAE,GAAG,CAAC,CAAA;QACrG,CAAC;QACD,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;QAChB,IAAI,CAAC,OAAO,GAAG,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAA;IACpD,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,KAAK,CAAC,IAAY;QACxB,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;QACzD,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YAC7D,MAAM,IAAI,aAAa,CAAC,sCAAsC,CAAC,CAAA;QAChE,CAAC;QAED,IAAI,IAAgB,CAAA;QACpB,IAAI,CAAC;YACJ,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;QAC3B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,MAAM,IAAI,aAAa,CAAC,iCAAiC,EAAE,GAAG,CAAC,CAAA;QAChE,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;QAClD,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACvB,MAAM,IAAI,aAAa,CAAC,mBAAmB,IAAI,+BAA+B,GAAG,CAAC,IAAI,EAAE,CAAC,CAAA;QAC1F,CAAC;QAED,OAAO,GAAG,CAAA;IACX,CAAC;IAED;;;OAGG;IACH,WAAW;QACV,OAAO,UAAU,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAA;IACzD,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,KAAgB;QACtB,OAAO,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAA;IACzC,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,OAA2B;QACtC,OAAO,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IACzC,CAAC;IAED;;OAEG;IACH,QAAQ;QACP,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAA;QAEtD,OAAO,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,IAAI,CAAC,OAAO,EAAE,CAAA;IACnE,CAAC;CACD;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,IAAI,CAAA;AAErC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,GAAc,EAAsB,EAAE;IAChE,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,SAAS,CAAA;IACjB,CAAC;IAED,sEAAsE;IACtE,wDAAwD;IACxD,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;IACnD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,SAAS,CAAA;IACjB,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,CAAC,CAAA;IACrD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAA;IAC5B,IAAI,KAAK,KAAK,CAAC,CAAC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACzC,OAAO,CAAC,CAAA;IACT,CAAC;IAED,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAA;AACnE,CAAC,CAAA;AAKD,MAAM,WAAW,GAAuE;IACvF,QAAQ,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE;IAC3C,QAAQ,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE;IAC3C,QAAQ,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE;CAC3C,CAAA;AAiBD,qBAAqB;AACrB,MAAM,UAAU,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAA;AAE/D,6DAA6D;AAC7D,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,KAAK,EAAE,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC;IAC/B,UAAU,EAAE,OAAO;IACnB,OAAO,EAAE,OAAO;IAChB,UAAU,EAAE,QAAQ;IACpB,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,QAAQ,CAAC;IACtC,WAAW,EAAE,QAAQ;CACrB,CAAC,CAAA;AAEF,6EAA6E;AAC7E,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,MAAM,EAAE,CAAC,CAAC,KAAK;IACf,MAAM,EAAE,CAAC,CAAC,KAAK;IACf,IAAI,EAAE,OAAO;CACb,CAAC,CAAA;AAEF,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,MAAM,EAAE,CAAC,CAAC,KAAK;IACf,MAAM,EAAE,CAAC,CAAC,KAAK;IACf,IAAI,EAAE,OAAO;IACb,SAAS,EAAE,QAAQ;IACnB,sCAAsC;IACtC,UAAU,EAAE,QAAQ;IACpB,OAAO,EAAE,OAAO;CAChB,CAAC,CAAA;AAEF,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,MAAM,EAAE,CAAC,CAAC,KAAK;IACf,MAAM,EAAE,CAAC,CAAC,KAAK;IACf,IAAI,EAAE,OAAO;IACb,KAAK,EAAE,OAAO;IACd,SAAS,EAAE,QAAQ;IACnB,WAAW;IACX,UAAU,EAAE,QAAQ;IACpB,OAAO,EAAE,OAAO;CAChB,CAAC,CAAA;AAEF;;GAEG;AACH,MAAM,WAAW,GAAG,CAAC,IAAY,EAAU,EAAE;IAC5C,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAA;AACrE,CAAC,CAAA;AAED,yCAAyC;AACzC,MAAM,SAAS,GAAG,CAAC,IAAY,EAA2B,EAAE;IAC3D,IAAI,CAAC;QACJ,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAA;IAC/D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,MAAM,IAAI,aAAa,CAAC,kCAAkC,EAAE,GAAG,CAAC,CAAA;IACjE,CAAC;AACF,CAAC,CAAA;AAED,wGAAwG;AACxG,MAAM,eAAe,GAAgI;IACpJ,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE;IACnD,GAAI,CAAC,UAAU,EAAE,UAAU,EAAE,UAAU,CAAW,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,OAAgB,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;CAC/K,CAAA;AAED,2EAA2E;AAC3E,gBAAgB;AAChB,MAAM,WAAW,GAAG,KAAK,EAAE,GAA4B,EAAE,SAAgE,EAAkC,EAAE;IAC5J,IAAI,CAAC;QACJ,OAAO,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC,CAAA;IAC9E,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,SAAS,CAAA;IACjB,CAAC;AACF,CAAC,CAAA;AAED,2EAA2E;AAC3E,sCAAsC;AACtC,MAAM,SAAS,GAAG,CAAC,GAAe,EAAE,IAAqB,EAAU,EAAE;IACpE,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,CAAA;IACvB,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,IAAI,aAAa,CAAC,4BAA4B,IAAI,iBAAiB,CAAC,CAAA;IAC3E,CAAC;IAED,OAAO,KAAK,CAAA;AACb,CAAC,CAAA;AAED;;;GAGG;AACH,MAAM,oBAAoB,GAAG,KAAK,EAAE,IAAY,EAAuB,EAAE;IACxE,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;IAE3B,KAAK,MAAM,SAAS,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,SAAS,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,SAAS,CAAC,SAAS,CAAC,CAAA;QAC7D,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC7B,SAAQ;QACT,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;QAC3D,MAAM,CAAC,GAAG,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;QAC7B,MAAM,CAAC,GAAG,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;QAE7B,IAAI,SAAS,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAClC,OAAO;gBACN,IAAI,EAAE,SAAS;gBACf,SAAS,EAAE,IAAI,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBACnI,GAAG,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,EAAE;aACzC,CAAA;QACF,CAAC;QAED,MAAM,CAAC,GAAG,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;QAC7B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,CAAC,IAAI,EAAE,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QAE9F,OAAO;YACN,IAAI,EAAE,OAAO;YACb,KAAK,EAAE,SAAS,CAAC,KAAK;YACtB,SAAS,EAAE,IAAI,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,cAAc,SAAS,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;YAC1K,GAAG,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,UAAU,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE;SACzE,CAAA;IACF,CAAC;IAED,uDAAuD;IACvD,IAAI,MAAM,WAAW,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,KAAK,SAAS,EAAE,CAAC;QAC1F,MAAM,IAAI,mBAAmB,CAAC,uEAAuE,CAAC,CAAA;IACvG,CAAC;IAED,sEAAsE;IACtE,6DAA6D;IAC7D,MAAM,IAAI,aAAa,CAAC,sGAAsG,CAAC,CAAA;AAChI,CAAC,CAAA;AAED;;;GAGG;AACH,MAAM,sBAAsB,GAAG,CAAC,IAAY,EAAc,EAAE;IAC3D,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;IAC7B,IAAI,SAAkD,CAAA;IACtD,IAAI,CAAC;QACJ,SAAS,GAAG,iBAAiB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAC5C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,MAAM,IAAI,aAAa,CAAC,kCAAkC,EAAE,GAAG,CAAC,CAAA;IACjE,CAAC;IAED,IAAI,SAAS,CAAC,UAAU,KAAK,MAAM,IAAI,SAAS,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC;QACrE,MAAM,IAAI,aAAa,CAAC,0CAA0C,CAAC,CAAA;IACpE,CAAC;IACD,IAAI,SAAS,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,aAAa,CAAC,yCAAyC,SAAS,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,CAAA;IAChG,CAAC;IAED,4EAA4E;IAC5E,MAAM,OAAO,GAAG,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAA;IAC1C,IAAI,KAAgD,CAAA;IACpD,IAAI,CAAC;QACJ,KAAK,GAAG,mBAAmB,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,EAAE,OAAO,CAAC,CAAA;IACnE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,MAAM,IAAI,aAAa,CAAC,kCAAkC,EAAE,GAAG,CAAC,CAAA;IACjE,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;QACnC,MAAM,IAAI,aAAa,CAAC,wCAAwC,CAAC,CAAA;IAClE,CAAC;IAED,IAAI,CAAC;QACJ,IAAI,KAAK,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;YAClC,MAAM,GAAG,GAAG,iBAAiB,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,EAAE,OAAO,CAAC,CAAA;YACpE,IAAI,GAAG,CAAC,SAAS,CAAC,MAAM,KAAK,EAAE,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;gBACjE,MAAM,IAAI,aAAa,CAAC,8CAA8C,CAAC,CAAA;YACxE,CAAC;YACD,MAAM,SAAS,GAAG,IAAI,SAAS,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAE,EAAE,GAAG,CAAC,OAAO,CAAC,CAAA;YACtE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC9H,MAAM,IAAI,aAAa,CAAC,0CAA0C,CAAC,CAAA;YACpE,CAAC;YAED,OAAO;gBACN,IAAI,EAAE,SAAS;gBACf,SAAS;gBACT,GAAG,EAAE;oBACJ,GAAG,EAAE,KAAK;oBACV,GAAG,EAAE,SAAS;oBACd,CAAC,EAAE,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBACxD,CAAC,EAAE,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC;iBACvC;aACD,CAAA;QACF,CAAC;QAED,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;YAC1C,MAAM,GAAG,GAAG,eAAe,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,EAAE,OAAO,CAAC,CAAA;YAClE,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,KAAmB,CAAC,CAAA;YAClD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC;gBACrE,MAAM,IAAI,mBAAmB,CAAC,eAAe,GAAG,CAAC,KAAK,mBAAmB,CAAC,CAAA;YAC3E,CAAC;YACD,IAAI,GAAG,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,GAAG,KAAK,CAAC,IAAI,GAAG,CAAC,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC9E,MAAM,IAAI,aAAa,CAAC,4CAA4C,GAAG,CAAC,KAAK,EAAE,CAAC,CAAA;YACjF,CAAC;YACD,MAAM,SAAS,GAAG,IAAI,SAAS,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAE,EAAE,GAAG,CAAC,OAAO,CAAC,CAAA;YACtE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;gBAChK,MAAM,IAAI,aAAa,CAAC,0CAA0C,CAAC,CAAA;YACpE,CAAC;YAED,OAAO;gBACN,IAAI,EAAE,OAAO;gBACb,KAAK,EAAE,GAAG,CAAC,KAAmB;gBAC9B,SAAS;gBACT,GAAG,EAAE;oBACJ,GAAG,EAAE,IAAI;oBACT,GAAG,EAAE,KAAK,CAAC,UAAU;oBACrB,6DAA6D;oBAC7D,CAAC,EAAE,cAAc,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;oBAClE,CAAC,EAAE,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;oBACnE,CAAC,EAAE,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;iBAChE;aACD,CAAA;QACF,CAAC;IACF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,IAAI,GAAG,YAAY,aAAa,IAAI,GAAG,YAAY,mBAAmB,EAAE,CAAC;YACxE,MAAM,GAAG,CAAA;QACV,CAAC;QACD,MAAM,IAAI,aAAa,CAAC,kCAAkC,EAAE,GAAG,CAAC,CAAA;IACjE,CAAC;IAED,MAAM,IAAI,mBAAmB,CAAC,eAAe,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,wDAAwD,CAAC,CAAA;AAC9H,CAAC,CAAA;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,EAAE,IAAY,EAAuB,EAAE;IAC1E,MAAM,OAAO,GAAG,gFAAgF,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC3G,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO,sBAAsB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAA;IAC1C,CAAC;IAED,MAAM,KAAK,GAAG,gEAAgE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACzF,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;QAC9B,OAAO,oBAAoB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;IACtC,CAAC;IAED,IAAI,IAAI,CAAC,QAAQ,CAAC,uCAAuC,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,aAAa,CAAC,0CAA0C,CAAC,CAAA;IACpE,CAAC;IAED,MAAM,IAAI,aAAa,CAAC,sLAAsL,CAAC,CAAA;AAChN,CAAC,CAAA"}

package/dist/types.d.ts

@@ -78,13 +78,53 @@ export interface CaSecret {
     get(): Promise<string>;
 }
 /**
- * The bindings (environment) the CA expects, see {@link CaDatabase} and
- * {@link CaSecret} for the non-string bindings.
+ * A rate limiter, with the same shape as a Cloudflare Workers rate limit
+ * binding.
+ *
+ * A Workers `RateLimit` binding satisfies this structurally. On other
+ * runtimes any limiter with the same shape may be used.
+ */
+export interface CaRateLimiter {
+    /**
+     * Counts a request against the limit for a key
+     *
+     * @param options The key the request is counted against, for example the client IP address
+     * @returns Whether the request is within the limit
+     */
+    limit(options: {
+        key: string;
+    }): Promise<{
+        success: boolean;
+    }>;
+}
+/**
+ * A key-value cache, with the subset of a Cloudflare Workers KV namespace
+ * binding used by the CA.
+ *
+ * A Workers `KVNamespace` binding satisfies this structurally. On other
+ * runtimes any cache with the same shape may be used, such as the in-memory
+ * cache returned by `cacheInMemory` from `@andrewheberle/serverless-ssh-ca/node`.
+ */
+export interface CaCache {
+    /** Returns the value for a key, or null if there is none */
+    get(key: string): Promise<string | null>;
+    /** Sets the value for a key, which may expire after `expirationTtl` seconds */
+    put(key: string, value: string, options?: {
+        expirationTtl?: number;
+    }): Promise<void>;
+}
+/**
+ * The bindings (environment) the CA expects, see {@link CaDatabase},
+ * {@link CaSecret}, {@link CaRateLimiter} and {@link CaCache} for the non-string
+ * bindings.
  */
 export interface SshCaBindings {
     CERTIFICATE_REQUEST_TIME_SKEW_MAX: string;
     JWT_ALGORITHMS: string | string[];
-    JWT_AUD?: string | string[];
+    /** The audience the identity token, and unless {@link SshCaBindings.JWT_ACCESS_TOKEN_AUD} is set the access token, must be issued for */
+    JWT_AUD: string | string[];
+    /** The audience the access token must be issued for, when it differs from {@link SshCaBindings.JWT_AUD} */
+    JWT_ACCESS_TOKEN_AUD?: string | string[];
     JWT_ISSUER: string;
     JWT_JWKS_URL: string;
     JWT_SSH_CERTIFICATE_PRINCIPALS_CLAIM: string;
@@ -93,6 +133,16 @@ export interface SshCaBindings {
     DB: CaDatabase;
     ISSUER_DN: string;
     PRIVATE_KEY: CaSecret;
+    /**
+     * Limits requests to issue, renew and revoke certificates, see
+     * {@link CaRateLimiter}. Requests are not limited when this is not set.
+     */
+    RATE_LIMITER?: CaRateLimiter;
+    /**
+     * Caches KRLs until a certificate is revoked, see {@link CaCache}. KRLs
+     * are generated for every request when this is not set.
+     */
+    CACHE?: CaCache;
     SSH_CERTIFICATE_EXTENSIONS: string;
     SSH_CERTIFICATE_INCLUDE_SELF_EMAIL?: string | boolean;
     SSH_CERTIFICATE_INCLUDE_SELF?: string | boolean;

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,MAAM,CAAA;AAGjC,MAAM,MAAM,wBAAwB,GAAG;IACnC,UAAU,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACd,KAAK,CAAC,EAAE,MAAM,CAAA;CACjB,CAAA;AAED,MAAM,MAAM,yBAAyB,GAAG;IACpC,WAAW,EAAE,MAAM,CAAA;CACtB,CAAA;AAGD,MAAM,MAAM,4BAA4B,GAAG;IACvC,KAAK,EAAE,MAAM,CAAA;IACb,GAAG,EAAE,MAAM,CAAA;IACX,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,EAAE,CAAA;CACnC,GAAG,UAAU,CAAA;AAEd;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC7B,kDAAkD;IAClD,OAAO,EAAE,OAAO,CAAA;IAChB,IAAI,CAAC,EAAE;QACH,kDAAkD;QAClD,OAAO,CAAC,EAAE,MAAM,CAAA;QAChB,yCAAyC;QACzC,WAAW,CAAC,EAAE,MAAM,CAAA;QACpB,6DAA6D;QAC7D,QAAQ,CAAC,EAAE,MAAM,CAAA;KACpB,CAAA;CACJ;AAED;;;GAGG;AACH,MAAM,WAAW,qBAAsB,SAAQ,gBAAgB;IAC3D,iEAAiE;IACjE,OAAO,EAAE,OAAO,EAAE,CAAA;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAChC,yEAAyE;IACzE,IAAI,CAAC,GAAG,MAAM,EAAE,OAAO,EAAE,GAAG,mBAAmB,CAAA;IAC/C,gDAAgD;IAChD,GAAG,IAAI,OAAO,CAAC,qBAAqB,CAAC,CAAA;IACrC,mDAAmD;IACnD,GAAG,IAAI,OAAO,CAAC,gBAAgB,CAAC,CAAA;CACnC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,UAAU;IACvB,yEAAyE;IACzE,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,mBAAmB,CAAA;IAC3C,kFAAkF;IAClF,KAAK,CAAC,UAAU,EAAE,mBAAmB,EAAE,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAA;IACrE,4DAA4D;IAC5D,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CACxC;AAED;;;;GAIG;AACH,MAAM,WAAW,QAAQ;IACrB,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,CAAA;CACzB;AAED;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC7B,iCAAiC,EAAE,MAAM,CAAA;IACzC,cAAc,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACjC,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IAC3B,UAAU,EAAE,MAAM,CAAA;IAClB,YAAY,EAAE,MAAM,CAAA;IACpB,oCAAoC,EAAE,MAAM,CAAA;IAC5C,SAAS,CAAC,EAAE,MAAM,CAAA;IACf,wBAAwB,EAAE,MAAM,CAAA;IAChC,EAAE,EAAE,UAAU,CAAA;IACd,SAAS,EAAE,MAAM,CAAA;IACjB,WAAW,EAAE,QAAQ,CAAA;IACrB,0BAA0B,EAAE,MAAM,CAAA;IAClC,kCAAkC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;IACrD,4BAA4B,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;IAC/C,wBAAwB,EAAE,MAAM,CAAA;IAChC,0BAA0B,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IAC9C,mCAAmC,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACvD,kCAAkC,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACtD,6BAA6B,EAAE,MAAM,CAAA;CACxC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,MAAM,CAAA;AAGjC,MAAM,MAAM,wBAAwB,GAAG;IACnC,UAAU,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACd,KAAK,CAAC,EAAE,MAAM,CAAA;CACjB,CAAA;AAED,MAAM,MAAM,yBAAyB,GAAG;IACpC,WAAW,EAAE,MAAM,CAAA;CACtB,CAAA;AAGD,MAAM,MAAM,4BAA4B,GAAG;IACvC,KAAK,EAAE,MAAM,CAAA;IACb,GAAG,EAAE,MAAM,CAAA;IACX,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,EAAE,CAAA;CACnC,GAAG,UAAU,CAAA;AAEd;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC7B,kDAAkD;IAClD,OAAO,EAAE,OAAO,CAAA;IAChB,IAAI,CAAC,EAAE;QACH,kDAAkD;QAClD,OAAO,CAAC,EAAE,MAAM,CAAA;QAChB,yCAAyC;QACzC,WAAW,CAAC,EAAE,MAAM,CAAA;QACpB,6DAA6D;QAC7D,QAAQ,CAAC,EAAE,MAAM,CAAA;KACpB,CAAA;CACJ;AAED;;;GAGG;AACH,MAAM,WAAW,qBAAsB,SAAQ,gBAAgB;IAC3D,iEAAiE;IACjE,OAAO,EAAE,OAAO,EAAE,CAAA;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAChC,yEAAyE;IACzE,IAAI,CAAC,GAAG,MAAM,EAAE,OAAO,EAAE,GAAG,mBAAmB,CAAA;IAC/C,gDAAgD;IAChD,GAAG,IAAI,OAAO,CAAC,qBAAqB,CAAC,CAAA;IACrC,mDAAmD;IACnD,GAAG,IAAI,OAAO,CAAC,gBAAgB,CAAC,CAAA;CACnC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,UAAU;IACvB,yEAAyE;IACzE,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,mBAAmB,CAAA;IAC3C,kFAAkF;IAClF,KAAK,CAAC,UAAU,EAAE,mBAAmB,EAAE,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAA;IACrE,4DAA4D;IAC5D,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CACxC;AAED;;;;GAIG;AACH,MAAM,WAAW,QAAQ;IACrB,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,CAAA;CACzB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC1B;;;;;OAKG;IACH,KAAK,CAAC,OAAO,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAA;CACjE;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,OAAO;IACpB,4DAA4D;IAC5D,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;IACxC,+EAA+E;IAC/E,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACvF;AAED;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC7B,iCAAiC,EAAE,MAAM,CAAA;IACzC,cAAc,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACjC,yIAAyI;IACzI,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IAC1B,2GAA2G;IAC3G,oBAAoB,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACxC,UAAU,EAAE,MAAM,CAAA;IAClB,YAAY,EAAE,MAAM,CAAA;IACpB,oCAAoC,EAAE,MAAM,CAAA;IAC5C,SAAS,CAAC,EAAE,MAAM,CAAA;IACf,wBAAwB,EAAE,MAAM,CAAA;IAChC,EAAE,EAAE,UAAU,CAAA;IACd,SAAS,EAAE,MAAM,CAAA;IACjB,WAAW,EAAE,QAAQ,CAAA;IACrB;;;OAGG;IACH,YAAY,CAAC,EAAE,aAAa,CAAA;IAC5B;;;OAGG;IACH,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,0BAA0B,EAAE,MAAM,CAAA;IAClC,kCAAkC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;IACrD,4BAA4B,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;IAC/C,wBAAwB,EAAE,MAAM,CAAA;IAChC,0BAA0B,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IAC9C,mCAAmC,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACvD,kCAAkC,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACtD,6BAA6B,EAAE,MAAM,CAAA;CACxC"}

package/dist/utils.d.ts

@@ -12,6 +12,38 @@ type AccessToken = {
     email: string;
     sub: string;
 };
+/**
+ * Thrown when a claim of a verified token is missing or is not of the
+ * expected type.
+ */
+export declare class TokenClaimError extends Error {
+    constructor(message: string);
+}
+/**
+ * Returns the subject of a verified token, which is compared between the
+ * access and identity tokens so must always be present.
+ *
+ * @param payload The payload of a verified token
+ * @returns The `sub` claim of the token
+ * @throws {@link TokenClaimError} when the `sub` claim is missing, empty or not a string
+ */
+export declare const tokenSubject: (payload: {
+    sub?: unknown;
+}) => string;
+/**
+ * Returns the email address of a verified access token, or why it cannot be
+ * used.
+ *
+ * @param payload The payload of a verified access token
+ * @returns The email address, or an error message if the claims are not acceptable
+ */
+export declare const tokenEmail: (payload: Record<string, unknown>) => {
+    ok: true;
+    email: string;
+} | {
+    ok: false;
+    error: string;
+};
 export declare const transformAuthorizationHeader: (env: SshCaBindings, val: string, ctx: z.RefinementCtx) => Promise<AccessToken | never>;
 /**
  * Parses a public key in OpenSSH format, `${type} ${base64}[ ${comment}]`
@@ -20,6 +52,22 @@ export declare const transformAuthorizationHeader: (env: SshCaBindings, val: str
  * @param ctx The Zod context for any errors
  */
 export declare const transformPublicKey: (val: string | Buffer<ArrayBufferLike>, ctx: z.RefinementCtx) => PublicKey | never;
+/**
+ * Returns why a public key cannot be issued a certificate, or undefined if it
+ * can be.
+ *
+ * RSA keys must be at least {@link MinimumRsaKeyBits} bits, as smaller keys
+ * can be factored and are refused by current OpenSSH releases.
+ *
+ * @param key The public key a certificate would be issued for
+ * @returns The reason the key cannot be used, or undefined if it can be
+ */
+export declare const subjectKeyIssue: (key: PublicKey) => string | undefined;
+/**
+ * Refines a public key so only one allowed by {@link subjectKeyIssue} is
+ * accepted for a certificate request.
+ */
+export declare const refineSubjectKey: (val: PublicKey, ctx: z.RefinementCtx) => void;
 /**
  * Thrown by {@link identityPrincipals} when the principals claim of an
  * identity token is not a string or an array of strings.
@@ -59,13 +107,32 @@ type ParsedHostCertificateRequest = {
     proof: ProofOfPossession;
 } & HostCertificateRequest;
 export declare const refineHostCertificateRequest: (env: SshCaBindings, val: ParsedHostCertificateRequest, ctx: z.RefinementCtx) => Promise<never>;
+/**
+ * Returns why a principal cannot be included on a host certificate, or
+ * undefined if it can be.
+ *
+ * OpenSSH matches the principals of a host certificate as patterns, so a
+ * principal such as `*` would make the certificate valid for every host that
+ * trusts the CA. Principals are otherwise not restricted, as hosts may be
+ * reached by IP address, bare host name or fully qualified domain name.
+ *
+ * @param principal The principal to check
+ * @returns The reason the principal cannot be used, or undefined if it can be
+ */
+export declare const hostPrincipalIssue: (principal: string) => string | undefined;
+/**
+ * Refines a host certificate principal so only one allowed by
+ * {@link hostPrincipalIssue} is accepted.
+ */
+export declare const refineHostPrincipal: (val: string, ctx: z.RefinementCtx) => void;
 type ParsedHostCertificateRenewal = {
     certificate: SshCertificate;
     proof: RenewalProofOfPossession;
 } & HostCertificateRequest;
 /**
  * Checks a certificate presented for renewal was issued by this CA, is a host
- * certificate, is within its validity period and has not been revoked.
+ * certificate whose principals are allowed (see {@link hostPrincipalIssue}),
+ * is within its validity period and has not been revoked.
  *
  * @param env The CA bindings
  * @param isRevoked Returns whether a serial has been revoked

package/dist/utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../src/utils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAE/C,OAAO,EAAyB,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAC5E,OAAO,EAAkC,SAAS,EAAE,mBAAmB,EAAE,KAAK,UAAU,EAAE,MAAM,eAAe,CAAA;AAC/G,OAAO,CAAC,MAAM,KAAK,CAAA;AAEnB,OAAO,EAAE,4BAA4B,EAAE,MAAM,YAAY,CAAA;AACzD,OAAO,EAAE,wBAAwB,EAAE,iBAAiB,EAAwB,MAAM,YAAY,CAAA;AAC9F,OAAO,KAAK,EAAE,SAAS,IAAI,WAAW,EAAE,MAAM,eAAe,CAAA;AAK7D,OAAO,EAAE,mBAAmB,EAAE,CAAA;AAE9B,eAAO,MAAM,UAAU,QAAS,CAAC,CAAC,aAAa,WAAW,MAAM,OAAO,OAAO,UAQ7E,CAAA;AAED,eAAO,MAAM,0BAA0B,QAAS,aAAa,OAAO,MAAM,OAAO,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,KAAG,iBAAiB,GAAG,KA0BpI,CAAA;AAED,KAAK,WAAW,GAAG;IAClB,KAAK,EAAE,MAAM,CAAA;IACb,GAAG,EAAE,MAAM,CAAA;CACX,CAAA;AAED,eAAO,MAAM,4BAA4B,QAAe,aAAa,OAAO,MAAM,OAAO,CAAC,CAAC,aAAa,KAAG,OAAO,CAAC,WAAW,GAAG,KAAK,CA6CrI,CAAA;AAOD;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,QAAS,MAAM,GAAG,MAAM,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,aAAa,KAAG,SAAS,GAAG,KA6B5G,CAAA;AAED;;;GAGG;AACH,qBAAa,oBAAqB,SAAQ,KAAK;IAC9C,YAAY,OAAO,EAAE,MAAM,EAK1B;CACD;AAID,eAAO,MAAM,kBAAkB,QAAS,aAAa,WAAW,4BAA4B,UAAU,MAAM,KAAG,MAAM,EAsCpH,CAAA;AAED,KAAK,aAAa,GAAG;IACpB,GAAG,EAAE,MAAM,CAAA;IACX,UAAU,EAAE,MAAM,EAAE,CAAA;CACpB,CAAA;AAED,eAAO,MAAM,aAAa,QAAe,aAAa,OAAO,MAAM,GAAG,SAAS,UAAU,MAAM,KAAG,OAAO,CAAC,aAAa,CActH,CAAA;AAED,eAAO,MAAM,sBAAsB,QAAe,aAAa,OAAO,MAAM,OAAO,CAAC,CAAC,aAAa,KAAG,OAAO,CAAC,aAAa,GAAG,KAAK,CAajI,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,QAAS,MAAM,GAAG,MAAM,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,aAAa,KAAG,cAAc,GAAG,KA6BnH,CAAA;AAED,KAAK,wBAAwB,GAAG;IAC/B,KAAK,EAAE,iBAAiB,CAAA;IACxB,UAAU,EAAE,SAAS,CAAA;IACrB,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,aAAa,CAAA;IACvB,UAAU,EAAE,MAAM,EAAE,CAAA;CACpB,CAAA;AAED,eAAO,MAAM,wBAAwB,QAAe,aAAa,OAAO,wBAAwB,OAAO,CAAC,CAAC,aAAa,KAAG,OAAO,CAAC,KAAK,CAmBrI,CAAA;AAED,eAAO,MAAM,iCAAiC,QAAS,aAAa,OAAO,MAAM,OAAO,CAAC,CAAC,aAAa,KAAG,wBAAwB,GAAG,KAYpI,CAAA;AAED,KAAK,sBAAsB,GAAG;IAC7B,UAAU,EAAE,SAAS,CAAA;IACrB,QAAQ,EAAE,MAAM,CAAA;CAChB,CAAA;AAED,KAAK,4BAA4B,GAAG;IACnC,UAAU,EAAE,MAAM,EAAE,CAAA;IACpB,KAAK,EAAE,iBAAiB,CAAA;CACxB,GAAG,sBAAsB,CAAA;AAE1B,eAAO,MAAM,4BAA4B,QAAe,aAAa,OAAO,4BAA4B,OAAO,CAAC,CAAC,aAAa,KAAG,OAAO,CAAC,KAAK,CA4B7I,CAAA;AAED,KAAK,4BAA4B,GAAG;IACnC,WAAW,EAAE,cAAc,CAAA;IAC3B,KAAK,EAAE,wBAAwB,CAAA;CAC/B,GAAG,sBAAsB,CAAA;AAE1B;;;;;;;;;GASG;AACH,eAAO,MAAM,yBAAyB,QAAe,aAAa,aAAa,OAAO,WAAW,eAAe,cAAc,KAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CA8B1J,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,0BAA0B,QAAe,aAAa,aAAa,OAAO,WAAW,OAAO;IAAE,WAAW,EAAE,cAAc,CAAA;CAAE,OAAO,CAAC,CAAC,aAAa,KAAG,OAAO,CAAC,KAAK,CAkB7K,CAAA;AAED,eAAO,MAAM,4BAA4B,QAAe,aAAa,aAAa,OAAO,WAAW,OAAO,4BAA4B,OAAO,CAAC,CAAC,aAAa,KAAG,OAAO,CAAC,KAAK,CA6B5K,CAAA;AAED,KAAK,uBAAuB,GAAG;IAC9B,MAAM,EAAE,MAAM,CAAA;IACd,UAAU,EAAE,SAAS,CAAA;IACrB,KAAK,EAAE,iBAAiB,CAAA;CACxB,CAAA;AAED,eAAO,MAAM,uBAAuB,QAAe,aAAa,OAAO,uBAAuB,OAAO,CAAC,CAAC,aAAa,KAAG,OAAO,CAAC,KAAK,CAmBnI,CAAA;AAED,eAAO,MAAM,KAAK,OAAQ,MAAM,GAAG,MAAM,EAAE,KAAG,MAAM,EAQnD,CAAA;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,aAAa,QAAe,aAAa,KAAG,OAAO,CAAC,UAAU,CAK1E,CAAA;AAED;;GAEG;AACH,eAAO,MAAM,SAAS,QAAe,aAAa,QAAQ,UAAU,KAAG,OAAO,CAAC,SAAS,CAMvF,CAAA"}
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../src/utils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAE/C,OAAO,EAAyB,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAC5E,OAAO,EAAqD,SAAS,EAAc,mBAAmB,EAAE,KAAK,UAAU,EAAE,MAAM,eAAe,CAAA;AAC9I,OAAO,CAAC,MAAM,KAAK,CAAA;AAEnB,OAAO,EAAE,4BAA4B,EAAE,MAAM,YAAY,CAAA;AACzD,OAAO,EAAE,wBAAwB,EAAE,iBAAiB,EAAwB,MAAM,YAAY,CAAA;AAC9F,OAAO,KAAK,EAAE,SAAS,IAAI,WAAW,EAAE,MAAM,eAAe,CAAA;AAK7D,OAAO,EAAE,mBAAmB,EAAE,CAAA;AAE9B,eAAO,MAAM,UAAU,QAAS,CAAC,CAAC,aAAa,WAAW,MAAM,OAAO,OAAO,UAQ7E,CAAA;AAED,eAAO,MAAM,0BAA0B,QAAS,aAAa,OAAO,MAAM,OAAO,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,KAAG,iBAAiB,GAAG,KA0BpI,CAAA;AAED,KAAK,WAAW,GAAG;IAClB,KAAK,EAAE,MAAM,CAAA;IACb,GAAG,EAAE,MAAM,CAAA;CACX,CAAA;AAED;;;GAGG;AACH,qBAAa,eAAgB,SAAQ,KAAK;IACzC,YAAY,OAAO,EAAE,MAAM,EAK1B;CACD;AAID;;;;;;;GAOG;AACH,eAAO,MAAM,YAAY,YAAa;IAAE,GAAG,CAAC,EAAE,OAAO,CAAA;CAAE,KAAG,MAOzD,CAAA;AAcD;;;;;;GAMG;AACH,eAAO,MAAM,UAAU,YAAa,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAerH,CAAA;AAED,eAAO,MAAM,4BAA4B,QAAe,aAAa,OAAO,MAAM,OAAO,CAAC,CAAC,aAAa,KAAG,OAAO,CAAC,WAAW,GAAG,KAAK,CAsDrI,CAAA;AAOD;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,QAAS,MAAM,GAAG,MAAM,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,aAAa,KAAG,SAAS,GAAG,KA6B5G,CAAA;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,eAAe,QAAS,SAAS,KAAG,MAAM,GAAG,SAOzD,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,gBAAgB,QAAS,SAAS,OAAO,CAAC,CAAC,aAAa,KAAG,IAKvE,CAAA;AAED;;;GAGG;AACH,qBAAa,oBAAqB,SAAQ,KAAK;IAC9C,YAAY,OAAO,EAAE,MAAM,EAK1B;CACD;AAID,eAAO,MAAM,kBAAkB,QAAS,aAAa,WAAW,4BAA4B,UAAU,MAAM,KAAG,MAAM,EAsCpH,CAAA;AAED,KAAK,aAAa,GAAG;IACpB,GAAG,EAAE,MAAM,CAAA;IACX,UAAU,EAAE,MAAM,EAAE,CAAA;CACpB,CAAA;AAED,eAAO,MAAM,aAAa,QAAe,aAAa,OAAO,MAAM,GAAG,SAAS,UAAU,MAAM,KAAG,OAAO,CAAC,aAAa,CActH,CAAA;AAED,eAAO,MAAM,sBAAsB,QAAe,aAAa,OAAO,MAAM,OAAO,CAAC,CAAC,aAAa,KAAG,OAAO,CAAC,aAAa,GAAG,KAAK,CAkBjI,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,QAAS,MAAM,GAAG,MAAM,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,aAAa,KAAG,cAAc,GAAG,KA6BnH,CAAA;AAED,KAAK,wBAAwB,GAAG;IAC/B,KAAK,EAAE,iBAAiB,CAAA;IACxB,UAAU,EAAE,SAAS,CAAA;IACrB,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,aAAa,CAAA;IACvB,UAAU,EAAE,MAAM,EAAE,CAAA;CACpB,CAAA;AAED,eAAO,MAAM,wBAAwB,QAAe,aAAa,OAAO,wBAAwB,OAAO,CAAC,CAAC,aAAa,KAAG,OAAO,CAAC,KAAK,CAmBrI,CAAA;AAED,eAAO,MAAM,iCAAiC,QAAS,aAAa,OAAO,MAAM,OAAO,CAAC,CAAC,aAAa,KAAG,wBAAwB,GAAG,KAYpI,CAAA;AAED,KAAK,sBAAsB,GAAG;IAC7B,UAAU,EAAE,SAAS,CAAA;IACrB,QAAQ,EAAE,MAAM,CAAA;CAChB,CAAA;AAED,KAAK,4BAA4B,GAAG;IACnC,UAAU,EAAE,MAAM,EAAE,CAAA;IACpB,KAAK,EAAE,iBAAiB,CAAA;CACxB,GAAG,sBAAsB,CAAA;AAE1B,eAAO,MAAM,4BAA4B,QAAe,aAAa,OAAO,4BAA4B,OAAO,CAAC,CAAC,aAAa,KAAG,OAAO,CAAC,KAAK,CA4B7I,CAAA;AAQD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,kBAAkB,cAAe,MAAM,KAAG,MAAM,GAAG,SAc/D,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,mBAAmB,QAAS,MAAM,OAAO,CAAC,CAAC,aAAa,KAAG,IAKvE,CAAA;AAED,KAAK,4BAA4B,GAAG;IACnC,WAAW,EAAE,cAAc,CAAA;IAC3B,KAAK,EAAE,wBAAwB,CAAA;CAC/B,GAAG,sBAAsB,CAAA;AAE1B;;;;;;;;;;GAUG;AACH,eAAO,MAAM,yBAAyB,QAAe,aAAa,aAAa,OAAO,WAAW,eAAe,cAAc,KAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CA8C1J,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,0BAA0B,QAAe,aAAa,aAAa,OAAO,WAAW,OAAO;IAAE,WAAW,EAAE,cAAc,CAAA;CAAE,OAAO,CAAC,CAAC,aAAa,KAAG,OAAO,CAAC,KAAK,CAkB7K,CAAA;AAED,eAAO,MAAM,4BAA4B,QAAe,aAAa,aAAa,OAAO,WAAW,OAAO,4BAA4B,OAAO,CAAC,CAAC,aAAa,KAAG,OAAO,CAAC,KAAK,CA6B5K,CAAA;AAED,KAAK,uBAAuB,GAAG;IAC9B,MAAM,EAAE,MAAM,CAAA;IACd,UAAU,EAAE,SAAS,CAAA;IACrB,KAAK,EAAE,iBAAiB,CAAA;CACxB,CAAA;AAED,eAAO,MAAM,uBAAuB,QAAe,aAAa,OAAO,uBAAuB,OAAO,CAAC,CAAC,aAAa,KAAG,OAAO,CAAC,KAAK,CAmBnI,CAAA;AAED,eAAO,MAAM,KAAK,OAAQ,MAAM,GAAG,MAAM,EAAE,KAAG,MAAM,EAQnD,CAAA;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,aAAa,QAAe,aAAa,KAAG,OAAO,CAAC,UAAU,CAK1E,CAAA;AAED;;GAEG;AACH,eAAO,MAAM,SAAS,QAAe,aAAa,QAAQ,UAAU,KAAG,OAAO,CAAC,SAAS,CAMvF,CAAA"}

package/dist/utils.js

@@ -1,8 +1,8 @@
 import { JWKInvalid, JWKSInvalid, JWSInvalid, JWSSignatureVerificationFailed, JWTClaimValidationFailed, JWTExpired, JWTInvalid } from "jose/errors";
 import { CertificateParseError, SshCertificate } from "./ssh/certificate.js";
-import { KeyParseError, parsePrivateKey, PublicKey, UnsupportedKeyError } from "./ssh/keys.js";
+import { KeyParseError, MinimumRsaKeyBits, parsePrivateKey, PublicKey, rsaKeyBits, UnsupportedKeyError } from "./ssh/keys.js";
 import z from "zod";
-import { verifyJWT } from "./verify.js";
+import { MissingAudienceError, verifyJWT } from "./verify.js";
 import { RenewalProofOfPossession, ProofOfPossession, PossessionParseError } from "./proof.js";
 import { logger } from "./logger.js";
 import { ms } from "itty-time";
@@ -42,6 +42,64 @@ export const transformProofOfPossession = (env, val, ctx) => {
         return z.NEVER;
     }
 };
+/**
+ * Thrown when a claim of a verified token is missing or is not of the
+ * expected type.
+ */
+export class TokenClaimError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "TokenClaimError";
+        Object.setPrototypeOf(this, TokenClaimError.prototype);
+    }
+}
+const SubjectClaimSchema = z.string().min(1);
+/**
+ * Returns the subject of a verified token, which is compared between the
+ * access and identity tokens so must always be present.
+ *
+ * @param payload The payload of a verified token
+ * @returns The `sub` claim of the token
+ * @throws {@link TokenClaimError} when the `sub` claim is missing, empty or not a string
+ */
+export const tokenSubject = (payload) => {
+    const parsed = SubjectClaimSchema.safeParse(payload.sub);
+    if (!parsed.success) {
+        throw new TokenClaimError("JWT was verified but was missing required sub claim");
+    }
+    return parsed.data;
+};
+/**
+ * The claims of an access token that identify the user's email address.
+ *
+ * `email_verified` is optional as not every IdP includes it, but when it is
+ * included it must be true, as an IdP may otherwise issue a token for an
+ * address the user has not shown they control.
+ */
+const EmailClaimsSchema = z.object({
+    email: z.email(),
+    email_verified: z.boolean().optional(),
+});
+/**
+ * Returns the email address of a verified access token, or why it cannot be
+ * used.
+ *
+ * @param payload The payload of a verified access token
+ * @returns The email address, or an error message if the claims are not acceptable
+ */
+export const tokenEmail = (payload) => {
+    if (payload.email === undefined) {
+        return { ok: false, error: "JWT was verified but was missing required email claim" };
+    }
+    const parsed = EmailClaimsSchema.safeParse(payload);
+    if (!parsed.success) {
+        return { ok: false, error: "JWT was verified but the email or email_verified claim was not valid" };
+    }
+    if (parsed.data.email_verified === false) {
+        return { ok: false, error: "JWT was verified but the email address has not been verified by the IdP" };
+    }
+    return { ok: true, email: parsed.data.email };
+};
 export const transformAuthorizationHeader = async (env, val, ctx) => {
     if (!val.startsWith("Bearer ") || val.length <= 7) {
         return fatalIssue(ctx, "authorization header must be a Bearer token", val);
@@ -52,18 +110,27 @@ export const transformAuthorizationHeader = async (env, val, ctx) => {
         return fatalIssue(ctx, "request did not contain a JWT", val);
     }
     try {
-        // verify jwt
-        const { payload } = await verifyJWT(env, jwt);
-        if (payload.email === undefined) {
-            return fatalIssue(ctx, "JWT was verified but was missing required email claim", val);
+        // verify jwt, which must be issued for this CA
+        const aud = split(env.JWT_ACCESS_TOKEN_AUD).length > 0 ? env.JWT_ACCESS_TOKEN_AUD : env.JWT_AUD;
+        const { payload } = await verifyJWT(env, jwt, aud);
+        const email = tokenEmail(payload);
+        if (!email.ok) {
+            l.warn(email.error, "in", "transformAuthorizationHeader");
+            return fatalIssue(ctx, email.error, val);
         }
         return {
-            email: payload.email,
-            sub: payload.sub,
+            email: email.email,
+            sub: tokenSubject(payload),
         };
     }
     catch (err) {
         switch (true) {
+            case (err instanceof MissingAudienceError):
+                // a misconfigured CA is a server error, not a validation failure
+                l.error(err.message, "in", "transformAuthorizationHeader");
+                throw new InternalServerErrorException(err.message);
+            case (err instanceof TokenClaimError):
+                return fatalIssue(ctx, err.message, val);
             case (err instanceof JWSInvalid):
                 return fatalIssue(ctx, "the access token was invalid", val);
             case (err instanceof JWTInvalid):
@@ -124,6 +191,33 @@ export const transformPublicKey = (val, ctx) => {
         return z.NEVER;
     }
 };
+/**
+ * Returns why a public key cannot be issued a certificate, or undefined if it
+ * can be.
+ *
+ * RSA keys must be at least {@link MinimumRsaKeyBits} bits, as smaller keys
+ * can be factored and are refused by current OpenSSH releases.
+ *
+ * @param key The public key a certificate would be issued for
+ * @returns The reason the key cannot be used, or undefined if it can be
+ */
+export const subjectKeyIssue = (key) => {
+    const bits = rsaKeyBits(key);
+    if (bits !== undefined && bits < MinimumRsaKeyBits) {
+        return `RSA keys must be at least ${MinimumRsaKeyBits} bits, not ${bits}`;
+    }
+    return undefined;
+};
+/**
+ * Refines a public key so only one allowed by {@link subjectKeyIssue} is
+ * accepted for a certificate request.
+ */
+export const refineSubjectKey = (val, ctx) => {
+    const issue = subjectKeyIssue(val);
+    if (issue !== undefined) {
+        fatalIssue(ctx, issue, val.toString());
+    }
+};
 /**
  * Thrown by {@link identityPrincipals} when the principals claim of an
  * identity token is not a string or an array of strings.
@@ -170,11 +264,11 @@ export const parseIdentity = async (env, jwt, claim) => {
     if (jwt === undefined) {
         throw new Error("missing identity token");
     }
-    const aud = split(env.JWT_AUD);
-    const { payload } = await verifyJWT(env, jwt, { aud: aud.length === 0 ? undefined : aud });
+    const { payload } = await verifyJWT(env, jwt, env.JWT_AUD);
+    const sub = tokenSubject(payload);
     const principals = identityPrincipals(env, payload, claim);
     return {
-        sub: payload.sub,
+        sub: sub,
         principals: principals,
     };
 };
@@ -184,9 +278,14 @@ export const transformIdentityToken = async (env, val, ctx) => {
         return identity;
     }
     catch (err) {
+        // a misconfigured CA is a server error, not a validation failure
+        if (err instanceof MissingAudienceError) {
+            logger(env).error(err.message, "in", "transformIdentityToken");
+            throw new InternalServerErrorException(err.message);
+        }
         ctx.issues.push({
             code: "custom",
-            message: err instanceof PrincipalsClaimError ? err.message : "problem parsing identity token",
+            message: err instanceof PrincipalsClaimError || err instanceof TokenClaimError ? err.message : "problem parsing identity token",
             input: val
         });
         return z.NEVER;
@@ -285,9 +384,49 @@ export const refineHostCertificateRequest = async (env, val, ctx) => {
         return fatalIssue(ctx, "proof of possession verification unhandled error", val);
     }
 };
+// characters that OpenSSH treats as pattern syntax when matching host
+// certificate principals, or that separate entries in a pattern list
+const HostPrincipalPatternChars = /[*?!,]/;
+// whitespace and control characters, which no host name contains
+const HostPrincipalInvalidChars = /[\s\p{Cc}]/u;
+/**
+ * Returns why a principal cannot be included on a host certificate, or
+ * undefined if it can be.
+ *
+ * OpenSSH matches the principals of a host certificate as patterns, so a
+ * principal such as `*` would make the certificate valid for every host that
+ * trusts the CA. Principals are otherwise not restricted, as hosts may be
+ * reached by IP address, bare host name or fully qualified domain name.
+ *
+ * @param principal The principal to check
+ * @returns The reason the principal cannot be used, or undefined if it can be
+ */
+export const hostPrincipalIssue = (principal) => {
+    if (principal === "") {
+        return "host certificate principals must not be empty";
+    }
+    if (HostPrincipalPatternChars.test(principal)) {
+        return `host certificate principal ${JSON.stringify(principal)} must not contain wildcard or pattern characters (*, ?, ! or ,)`;
+    }
+    if (HostPrincipalInvalidChars.test(principal)) {
+        return `host certificate principal ${JSON.stringify(principal)} must not contain whitespace or control characters`;
+    }
+    return undefined;
+};
+/**
+ * Refines a host certificate principal so only one allowed by
+ * {@link hostPrincipalIssue} is accepted.
+ */
+export const refineHostPrincipal = (val, ctx) => {
+    const issue = hostPrincipalIssue(val);
+    if (issue !== undefined) {
+        fatalIssue(ctx, issue, val);
+    }
+};
 /**
  * Checks a certificate presented for renewal was issued by this CA, is a host
- * certificate, is within its validity period and has not been revoked.
+ * certificate whose principals are allowed (see {@link hostPrincipalIssue}),
+ * is within its validity period and has not been revoked.
  *
  * @param env The CA bindings
  * @param isRevoked Returns whether a serial has been revoked
@@ -306,6 +445,20 @@ export const checkRenewableCertificate = async (env, isRevoked, certificate) =>
     if (certificate.kind !== "host") {
         return "the provided certificate is not a host certificate";
     }
+    // a certificate issued before small RSA keys were refused must not be
+    // renewed, as the renewal would keep its key
+    const keyIssue = subjectKeyIssue(certificate.publicKey);
+    if (keyIssue !== undefined) {
+        return `the provided certificate cannot be renewed: ${keyIssue}`;
+    }
+    // a certificate issued before wildcard principals were refused must not
+    // be renewed, as the renewal would keep its principals
+    for (const principal of certificate.principals) {
+        const issue = hostPrincipalIssue(principal);
+        if (issue !== undefined) {
+            return `the provided certificate cannot be renewed: ${issue}`;
+        }
+    }
     // check certificate is within its validity period, allowing for clock
     // skew at the start as a certificate issued moments ago may have a
     // validity start up to a second in the future