@metric-im/administrate 1.1.0 → 1.1.3

package/.claude/settings.local.json

@@ -1,13 +1,10 @@
 {
   "permissions": {
     "allow": [
-      "Read(//home/msprague/workspace/rootz/epistery/docs/**)",
-      "Read(//home/msprague/workspace/rootz/epistery/src/**)",
-      "Read(//home/msprague/workspace/rootz/epistery/**)",
-      "Read(//home/msprague/workspace/rootz/rhonda/node_modules/epistery/**)",
-      "Read(//home/msprague/workspace/rootz/rhonda/**)"
+      "Read(//home/msprague/workspace/sitewell/**)",
+      "Read(//home/msprague/workspace/rootz/data-wallet-demos/**)"
     ],
     "deny": [],
     "ask": []
   }
-}
+}

package/certify.mjs

@@ -17,11 +17,12 @@ export class Certify {
     }
     static async attach(app,options) {
         const instance = new Certify(app,options);
-        instance.config = new Config(); // Uses default 'epistery' root
+        instance.config = new Config();
 
         // Load root config to get contact email
         instance.config.setPath('/');
         instance.config.load();
+
         instance.contactEmail = instance.options.contactEmail || instance.config.data.ssl?.email || instance.config.data.profile?.email;
 
         instance.acme = new Acme.Client({
@@ -117,7 +118,7 @@ export class Certify {
         return;
       } else {
         if (!this.contactEmail) throw new Error(`cannot request certificate without CONTACT_EMAIL set`);
-        this.pending[sitename] = true;
+        this.pending[sitename] = moment();
 
         try {
           // Add timeout wrapper for the entire certificate renewal process
@@ -136,10 +137,29 @@ export class Certify {
     }
 
     async doRenewCert(sitename) {
-      // create CSR
-      const [key, csr] = await Acme.crypto.createCsr({
+      // Check if domain has an epistery address
+      const domainConfig = this.config.read(sitename);
+      const episteryAddress = domainConfig?.wallet?.address;
+
+      // Prepare CSR options
+      const csrOptions = {
         altNames: [sitename],
-      });
+      };
+
+      // If epistery address exists, bind it to the certificate per X.509 standards
+      if (episteryAddress) {
+        // RFC 5280: Use organization (O) field to identify Rootz Corp as binding provider
+        csrOptions.organization = 'Rootz Corp';
+        // RFC 5280: Use organizationUnit (OU) to store epistery identity address
+        // This binds the domain to the epistery address in the certificate
+        // Users can verify at /.well-known/epistery/status (RFC 8615 well-known URI)
+        csrOptions.organizationUnit = `Epistery: ${episteryAddress}`;
+        console.log(`Binding epistery identity ${episteryAddress} to certificate for ${sitename}`);
+        console.log(`Epistery binding verifiable at https://${sitename}/.well-known/epistery/status`);
+      }
+
+      // create CSR
+      const [key, csr] = await Acme.crypto.createCsr(csrOptions);
 
       // order certificate with timeout
       const cert = await this.acme.auto({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@metric-im/administrate",
-  "version": "1.1.0",
+  "version": "1.1.3",
   "description": "Tools for site administration",
   "homepage": "https://github.com/metric-im/administrate#readme",
   "bugs": {
@@ -25,6 +25,6 @@
     "moment": "^2.30.1"
   },
   "peerDependencies": {
-    "epistery": "^1.0.0"
+    "epistery": "^1.0.3"
   }
 }