@camstack/system 1.2.356 → 1.2.357

package/dist/{tls-ue_Xefmv.js → tls-CCMX7MjX.js}

@@ -11249,7 +11249,7 @@ var Pkcs10CertificateRequest = class extends PemData {
 _Pkcs10CertificateRequest_tbs = /* @__PURE__ */ new WeakMap(), _Pkcs10CertificateRequest_subjectName = /* @__PURE__ */ new WeakMap(), _Pkcs10CertificateRequest_subject = /* @__PURE__ */ new WeakMap(), _Pkcs10CertificateRequest_signatureAlgorithm = /* @__PURE__ */ new WeakMap(), _Pkcs10CertificateRequest_signature = /* @__PURE__ */ new WeakMap(), _Pkcs10CertificateRequest_publicKey = /* @__PURE__ */ new WeakMap(), _Pkcs10CertificateRequest_attributes = /* @__PURE__ */ new WeakMap(), _Pkcs10CertificateRequest_extensions = /* @__PURE__ */ new WeakMap();
 Pkcs10CertificateRequest.NAME = "PKCS#10 Certificate Request";
 var _X509Certificate_tbs, _X509Certificate_serialNumber, _X509Certificate_subjectName, _X509Certificate_subject, _X509Certificate_issuerName, _X509Certificate_issuer, _X509Certificate_notBefore, _X509Certificate_notAfter, _X509Certificate_signatureAlgorithm, _X509Certificate_signature, _X509Certificate_extensions, _X509Certificate_publicKey;
-var X509Certificate$3 = class extends PemData {
+var X509Certificate$4 = class extends PemData {
 	get publicKey() {
 		if (!__classPrivateFieldGet(this, _X509Certificate_publicKey, "f")) __classPrivateFieldSet(this, _X509Certificate_publicKey, new PublicKey(this.asn.tbsCertificate.subjectPublicKeyInfo), "f");
 		return __classPrivateFieldGet(this, _X509Certificate_publicKey, "f");
@@ -11449,7 +11449,7 @@ var X509Certificate$3 = class extends PemData {
 	}
 };
 _X509Certificate_tbs = /* @__PURE__ */ new WeakMap(), _X509Certificate_serialNumber = /* @__PURE__ */ new WeakMap(), _X509Certificate_subjectName = /* @__PURE__ */ new WeakMap(), _X509Certificate_subject = /* @__PURE__ */ new WeakMap(), _X509Certificate_issuerName = /* @__PURE__ */ new WeakMap(), _X509Certificate_issuer = /* @__PURE__ */ new WeakMap(), _X509Certificate_notBefore = /* @__PURE__ */ new WeakMap(), _X509Certificate_notAfter = /* @__PURE__ */ new WeakMap(), _X509Certificate_signatureAlgorithm = /* @__PURE__ */ new WeakMap(), _X509Certificate_signature = /* @__PURE__ */ new WeakMap(), _X509Certificate_extensions = /* @__PURE__ */ new WeakMap(), _X509Certificate_publicKey = /* @__PURE__ */ new WeakMap();
-X509Certificate$3.NAME = "Certificate";
+X509Certificate$4.NAME = "Certificate";
 function generateCertificateSerialNumber(input, crypto = cryptoProvider.get()) {
 	const inputView = BufferSourceConverter.toUint8Array(Convert.FromHex(input || ""));
 	let serialNumber = inputView && inputView.length && inputView.some((o) => o > 0) ? new Uint8Array(inputView) : void 0;
@@ -11530,7 +11530,7 @@ var X509CertificateGenerator = class {
 		}
 		if (!asnSignature) throw Error("Cannot convert ASN.1 signature value to WebCrypto format");
 		asnX509.signatureValue = asnSignature;
-		return new X509Certificate$3(AsnConvert.serialize(asnX509));
+		return new X509Certificate$4(AsnConvert.serialize(asnX509));
 	}
 };
 var X509CrlReason;
@@ -11646,7 +11646,7 @@ async function loadCa(certPem, keyPem) {
 	return {
 		certPem,
 		keyPem,
-		cert: new X509Certificate$3(certPem),
+		cert: new X509Certificate$4(certPem),
 		privateKey: await node_crypto.webcrypto.subtle.importKey("pkcs8", PemConverter.decodeFirst(keyPem), SIGNING_ALGORITHM, true, ["sign"])
 	};
 }
@@ -11862,45 +11862,6 @@ function loadTlsCert(certPath, keyPath) {
 	};
 }
 //#endregion
-//#region src/tls/uploaded-cert.ts
-/**
-* Operator-supplied material must parse, match its key, and carry
-* `extendedKeyUsage = serverAuth` — the same leaf defects D227 refused
-* to keep generating.
-*/
-function validateUploadedTls(certPem, keyPem) {
-	let leaf;
-	try {
-		leaf = new node_crypto.X509Certificate(certPem);
-	} catch {
-		return {
-			ok: false,
-			error: "Certificate PEM could not be parsed."
-		};
-	}
-	try {
-		if (!leaf.checkPrivateKey((0, node_crypto.createPrivateKey)(keyPem))) return {
-			ok: false,
-			error: "Private key does not match the certificate."
-		};
-	} catch {
-		return {
-			ok: false,
-			error: "Private key PEM could not be parsed."
-		};
-	}
-	const eku = leaf.keyUsage;
-	if (eku === void 0 || !eku.includes("1.3.6.1.5.5.7.3.1")) return {
-		ok: false,
-		error: "Certificate is missing extendedKeyUsage = serverAuth."
-	};
-	return {
-		ok: true,
-		fingerprintSha256: leaf.fingerprint256,
-		validTo: new Date(leaf.validTo).toISOString()
-	};
-}
-//#endregion
 //#region src/tls/tls-status.ts
 function tlsDir(dataDir) {
 	return (0, node_path.join)(dataDir, "tls");
@@ -11933,10 +11894,51 @@ function writeExtraSans(dataDir, sans) {
 	(0, node_fs.mkdirSync)(tlsDir(dataDir), { recursive: true });
 	(0, node_fs.writeFileSync)((0, node_path.join)(tlsDir(dataDir), "extra-sans.json"), `${JSON.stringify(sans)}\n`, "utf-8");
 }
-function readTlsAccessStatus(dataDir, restartRequired = false) {
+/** Where an upload's own CA is kept — never over the local CA's `camstack-ca.crt`. */
+var UPLOADED_CA_FILE = "uploaded-ca.crt";
+/** Every certificate in a PEM bundle, in order. */
+function splitPemCertificates(pem) {
+	const blocks = pem.match(/-----BEGIN CERTIFICATE-----[\s\S]+?-----END CERTIFICATE-----/g);
+	return blocks === null ? [] : blocks.map((block) => `${block}\n`);
+}
+/**
+* The certificate that signed `leaf`, from the upload itself: the CA the
+* operator supplied, else the rest of the uploaded chain. `null` when the
+* upload did not include it — and then nothing may stand in for it: the
+* local CA did not sign an uploaded leaf, so handing it out as "the CA" would
+* tell a client to trust a root that verifies nothing it is served.
+*/
+function uploadedIssuer(dir, leaf, chainPem) {
+	const caPath = (0, node_path.join)(dir, UPLOADED_CA_FILE);
+	const candidates = [...(0, node_fs.existsSync)(caPath) ? splitPemCertificates((0, node_fs.readFileSync)(caPath, "utf-8")) : [], ...splitPemCertificates(chainPem).slice(1)];
+	for (const pem of candidates) try {
+		const cert = new node_crypto.X509Certificate(pem);
+		if (leaf.checkIssued(cert) && leaf.verify(cert.publicKey)) return {
+			pem,
+			cert
+		};
+	} catch {}
+	return null;
+}
+function generatedIssuer(dir) {
+	const caPath = (0, node_path.join)(dir, "camstack-ca.crt");
+	if (!(0, node_fs.existsSync)(caPath)) return null;
+	const pem = (0, node_fs.readFileSync)(caPath, "utf-8");
+	return {
+		pem,
+		cert: new node_crypto.X509Certificate(pem)
+	};
+}
+/**
+* What the node's certificate is, and whether the listener serves it.
+* `servedLeafFingerprint` is the leaf the HTTPS listener presents right now
+* (`servedHttpsLeafFingerprint()`), or `null` when unknown; a restart is
+* required exactly when the listener serves a different leaf than the one
+* on disk — a measured fact, not a flag a mutation remembered to set.
+*/
+function readTlsAccessStatus(dataDir, servedLeafFingerprint) {
 	const dir = tlsDir(dataDir);
 	const certPath = (0, node_path.join)(dir, "camstack.crt");
-	const caPath = (0, node_path.join)(dir, "camstack-ca.crt");
 	const mode = readTlsMode(dataDir);
 	if (!(0, node_fs.existsSync)(certPath)) return {
 		mode: "disabled",
@@ -11944,24 +11946,24 @@ function readTlsAccessStatus(dataDir, restartRequired = false) {
 		caFingerprintSha256: null,
 		validTo: null,
 		sans: [],
-		caCertPem: (0, node_fs.existsSync)(caPath) ? (0, node_fs.readFileSync)(caPath, "utf-8") : null,
+		caCertPem: (mode === "uploaded" ? null : generatedIssuer(dir))?.pem ?? null,
 		reissueError: null,
-		restartRequired
+		restartRequired: false
 	};
 	try {
-		const leaf = new node_crypto.X509Certificate((0, node_fs.readFileSync)(certPath));
-		const caPem = (0, node_fs.existsSync)(caPath) ? (0, node_fs.readFileSync)(caPath, "utf-8") : null;
-		const ca = caPem !== null ? new node_crypto.X509Certificate(caPem) : null;
+		const chainPem = (0, node_fs.readFileSync)(certPath, "utf-8");
+		const leaf = new node_crypto.X509Certificate(chainPem);
+		const ca = mode === "uploaded" ? uploadedIssuer(dir, leaf, chainPem) : generatedIssuer(dir);
 		const san = leaf.subjectAltName ?? "";
 		return {
 			mode,
 			leafFingerprintSha256: leaf.fingerprint256,
-			caFingerprintSha256: ca?.fingerprint256 ?? null,
+			caFingerprintSha256: ca?.cert.fingerprint256 ?? null,
 			validTo: new Date(leaf.validTo).toISOString(),
 			sans: san === "" ? [] : san.split(", "),
-			caCertPem: caPem,
+			caCertPem: ca?.pem ?? null,
 			reissueError: null,
-			restartRequired
+			restartRequired: servedLeafFingerprint !== null && servedLeafFingerprint !== leaf.fingerprint256
 		};
 	} catch {
 		return {
@@ -11972,11 +11974,202 @@ function readTlsAccessStatus(dataDir, restartRequired = false) {
 			sans: [],
 			caCertPem: null,
 			reissueError: "Certificate on disk could not be parsed.",
-			restartRequired
+			restartRequired: false
 		};
 	}
 }
 //#endregion
+//#region src/tls/boot-tls.ts
+/**
+* Decide what the listener serves at boot. The admin UI (Network → Local
+* access) is the only way to set a certificate (D726): it either leaves the
+* hub on its generated local-CA leaf (D227) or uploads one, recorded by the
+* `tls/mode` marker. An uploaded certificate is served verbatim — running it
+* through `ensureTlsCert` would replace it on the first restart, because a
+* leaf the local root did not issue is one of that rule's reissue triggers.
+*/
+async function prepareBootTls(dataDir, options) {
+	const certPath = (0, node_path.join)(dataDir, "tls", "camstack.crt");
+	const keyPath = (0, node_path.join)(dataDir, "tls", "camstack.key");
+	const marked = readTlsMode(dataDir);
+	if (marked === "uploaded" && (0, node_fs.existsSync)(certPath) && (0, node_fs.existsSync)(keyPath)) return {
+		mode: "uploaded",
+		pair: loadTlsCert(certPath, keyPath),
+		ensured: void 0,
+		uploadedMissing: false
+	};
+	const uploadedMissing = marked === "uploaded";
+	if (uploadedMissing) writeTlsMode(dataDir, "generated");
+	const ensured = await ensureTlsCert(dataDir, options);
+	return {
+		mode: "generated",
+		pair: loadTlsCert(ensured.certPath, ensured.keyPath),
+		ensured,
+		uploadedMissing
+	};
+}
+//#endregion
+//#region src/tls/https-listener.ts
+var SLOT_KEY = Symbol.for("camstack.tls.https-listener");
+var EMPTY_SLOT = {
+	reload: null,
+	servedLeafFingerprint: null
+};
+function isSlot(value) {
+	if (typeof value !== "object" || value === null) return false;
+	if (!("reload" in value) || !("servedLeafFingerprint" in value)) return false;
+	const reload = value.reload;
+	const served = value.servedLeafFingerprint;
+	return (reload === null || typeof reload === "function") && (served === null || typeof served === "string");
+}
+function readSlot() {
+	const current = Reflect.get(globalThis, SLOT_KEY);
+	return isSlot(current) ? current : EMPTY_SLOT;
+}
+function writeSlot(next) {
+	Reflect.set(globalThis, SLOT_KEY, next);
+}
+/** SHA-256 fingerprint of the first certificate (the leaf) in a PEM chain. */
+function leafFingerprintOf(chain) {
+	return new node_crypto.X509Certificate(chain).fingerprint256;
+}
+/**
+* Called once by the server after its HTTPS listener is up, with the pair it
+* was started on. From here on a certificate action swaps the served
+* certificate in place (`setSecureContext`) — new handshakes get the new
+* leaf, open connections keep theirs, nothing restarts.
+*/
+function registerHttpsListener(server, pair) {
+	writeSlot({
+		reload: (next) => server.setSecureContext({
+			cert: next.cert,
+			key: next.key
+		}),
+		servedLeafFingerprint: leafFingerprintOf(pair.cert)
+	});
+}
+/** Forget the listener — on shutdown, and between specs. */
+function clearHttpsListener() {
+	writeSlot(EMPTY_SLOT);
+}
+/**
+* The leaf the HTTPS listener serves now, or `null` when this process has no
+* registered listener (TLS off, or a process that does not own one) — in
+* which case nobody can say, and `null` is the honest answer.
+*/
+function servedHttpsLeafFingerprint() {
+	return readSlot().servedLeafFingerprint;
+}
+/** Serve `pair` from now on. Never throws: the outcome says what happened. */
+function reloadHttpsListener(pair) {
+	const slot = readSlot();
+	if (slot.reload === null) return { kind: "no-listener" };
+	try {
+		const servedLeafFingerprint = leafFingerprintOf(pair.cert);
+		slot.reload(pair);
+		writeSlot({
+			reload: slot.reload,
+			servedLeafFingerprint
+		});
+		return {
+			kind: "reloaded",
+			servedLeafFingerprint
+		};
+	} catch (err) {
+		return {
+			kind: "failed",
+			error: err instanceof Error ? err.message : String(err)
+		};
+	}
+}
+//#endregion
+//#region src/tls/uploaded-cert.ts
+/**
+* Operator-supplied material must parse, match its key, and carry
+* `extendedKeyUsage = serverAuth` — the same leaf defects D227 refused
+* to keep generating.
+*/
+function validateUploadedTls(certPem, keyPem) {
+	let leaf;
+	try {
+		leaf = new node_crypto.X509Certificate(certPem);
+	} catch {
+		return {
+			ok: false,
+			error: "Certificate PEM could not be parsed."
+		};
+	}
+	try {
+		if (!leaf.checkPrivateKey((0, node_crypto.createPrivateKey)(keyPem))) return {
+			ok: false,
+			error: "Private key does not match the certificate."
+		};
+	} catch {
+		return {
+			ok: false,
+			error: "Private key PEM could not be parsed."
+		};
+	}
+	const eku = leaf.keyUsage;
+	if (eku === void 0 || !eku.includes("1.3.6.1.5.5.7.3.1")) return {
+		ok: false,
+		error: "Certificate is missing extendedKeyUsage = serverAuth."
+	};
+	return {
+		ok: true,
+		fingerprintSha256: leaf.fingerprint256,
+		validTo: new Date(leaf.validTo).toISOString()
+	};
+}
+//#endregion
+//#region src/tls/tls-actions.ts
+function withNewline(pem) {
+	return pem.endsWith("\n") ? pem : `${pem}\n`;
+}
+/**
+* Store an operator's certificate. The leaf (or chain) and key replace the
+* served pair; a CA, when given, goes to its own file. The local CA
+* (`camstack-ca.crt` + key) is never touched — it did not sign the upload,
+* and it is what "Revert to generated" and every device that trusts it
+* still need.
+*/
+async function storeUploadedCertificate(dataDir, input) {
+	const valid = validateUploadedTls(input.certPem, input.keyPem);
+	if (!valid.ok) throw new Error(valid.error);
+	const dir = (0, node_path.join)(dataDir, "tls");
+	await (0, node_fs_promises.mkdir)(dir, { recursive: true });
+	await (0, node_fs_promises.writeFile)((0, node_path.join)(dir, "camstack.crt"), withNewline(input.certPem));
+	await (0, node_fs_promises.writeFile)((0, node_path.join)(dir, "camstack.key"), withNewline(input.keyPem), { mode: 384 });
+	const caPath = (0, node_path.join)(dir, UPLOADED_CA_FILE);
+	if (input.caPem !== void 0 && input.caPem.trim() !== "") await (0, node_fs_promises.writeFile)(caPath, withNewline(input.caPem));
+	else (0, node_fs.rmSync)(caPath, { force: true });
+	writeTlsMode(dataDir, "uploaded");
+}
+/** Issue a new generated leaf under the local CA. Refused while an upload is served. */
+async function regenerateCertificate(dataDir, options) {
+	if (readTlsMode(dataDir) === "uploaded") throw new Error("Cannot regenerate an uploaded certificate — revert to generated first.");
+	await reissueTlsLeaf(dataDir, options);
+}
+/** Drop the upload and serve the generated local-CA leaf again (D227). */
+async function revertToGeneratedCertificate(dataDir, options) {
+	writeTlsMode(dataDir, "generated");
+	(0, node_fs.rmSync)((0, node_path.join)(dataDir, "tls", UPLOADED_CA_FILE), { force: true });
+	await ensureTlsCert(dataDir, options);
+}
+/**
+* Put the pair on disk on the HTTPS listener. Called after every action, so
+* "the certificate changed" and "clients see it" are the same moment.
+*/
+function applyCertificateToListener(dataDir) {
+	const certPath = (0, node_path.join)(dataDir, "tls", "camstack.crt");
+	const keyPath = (0, node_path.join)(dataDir, "tls", "camstack.key");
+	if (!(0, node_fs.existsSync)(certPath) || !(0, node_fs.existsSync)(keyPath)) return {
+		kind: "failed",
+		error: `No certificate pair under ${(0, node_path.join)(dataDir, "tls")}`
+	};
+	return reloadHttpsListener(loadTlsCert(certPath, keyPath));
+}
+//#endregion
 Object.defineProperty(exports, "CA_COMMON_NAME", {
 	enumerable: true,
 	get: function() {
@@ -12013,12 +12206,24 @@ Object.defineProperty(exports, "SERVER_AUTH_OID", {
 		return SERVER_AUTH_OID;
 	}
 });
+Object.defineProperty(exports, "UPLOADED_CA_FILE", {
+	enumerable: true,
+	get: function() {
+		return UPLOADED_CA_FILE;
+	}
+});
 Object.defineProperty(exports, "allFamiliesListenHost", {
 	enumerable: true,
 	get: function() {
 		return allFamiliesListenHost;
 	}
 });
+Object.defineProperty(exports, "applyCertificateToListener", {
+	enumerable: true,
+	get: function() {
+		return applyCertificateToListener;
+	}
+});
 Object.defineProperty(exports, "applyLanHttp", {
 	enumerable: true,
 	get: function() {
@@ -12031,6 +12236,12 @@ Object.defineProperty(exports, "bindPendingLanHttp", {
 		return bindPendingLanHttp;
 	}
 });
+Object.defineProperty(exports, "clearHttpsListener", {
+	enumerable: true,
+	get: function() {
+		return clearHttpsListener;
+	}
+});
 Object.defineProperty(exports, "closeLanHttp", {
 	enumerable: true,
 	get: function() {
@@ -12055,12 +12266,24 @@ Object.defineProperty(exports, "evaluateExistingCert", {
 		return evaluateExistingCert;
 	}
 });
+Object.defineProperty(exports, "leafFingerprintOf", {
+	enumerable: true,
+	get: function() {
+		return leafFingerprintOf;
+	}
+});
 Object.defineProperty(exports, "loadTlsCert", {
 	enumerable: true,
 	get: function() {
 		return loadTlsCert;
 	}
 });
+Object.defineProperty(exports, "prepareBootTls", {
+	enumerable: true,
+	get: function() {
+		return prepareBootTls;
+	}
+});
 Object.defineProperty(exports, "readExtraSans", {
 	enumerable: true,
 	get: function() {
@@ -12085,6 +12308,18 @@ Object.defineProperty(exports, "readTlsMode", {
 		return readTlsMode;
 	}
 });
+Object.defineProperty(exports, "regenerateCertificate", {
+	enumerable: true,
+	get: function() {
+		return regenerateCertificate;
+	}
+});
+Object.defineProperty(exports, "registerHttpsListener", {
+	enumerable: true,
+	get: function() {
+		return registerHttpsListener;
+	}
+});
 Object.defineProperty(exports, "registerLanHttpHandler", {
 	enumerable: true,
 	get: function() {
@@ -12097,6 +12332,36 @@ Object.defineProperty(exports, "reissueTlsLeaf", {
 		return reissueTlsLeaf;
 	}
 });
+Object.defineProperty(exports, "reloadHttpsListener", {
+	enumerable: true,
+	get: function() {
+		return reloadHttpsListener;
+	}
+});
+Object.defineProperty(exports, "revertToGeneratedCertificate", {
+	enumerable: true,
+	get: function() {
+		return revertToGeneratedCertificate;
+	}
+});
+Object.defineProperty(exports, "servedHttpsLeafFingerprint", {
+	enumerable: true,
+	get: function() {
+		return servedHttpsLeafFingerprint;
+	}
+});
+Object.defineProperty(exports, "splitPemCertificates", {
+	enumerable: true,
+	get: function() {
+		return splitPemCertificates;
+	}
+});
+Object.defineProperty(exports, "storeUploadedCertificate", {
+	enumerable: true,
+	get: function() {
+		return storeUploadedCertificate;
+	}
+});
 Object.defineProperty(exports, "validateUploadedTls", {
 	enumerable: true,
 	get: function() {