@push.rocks/smartacme 4.0.8 → 6.0.0

package/ts/smartacme.classes.smartacme.ts

@@ -1,7 +1,8 @@
 import * as plugins from './smartacme.plugins.js';
-import { Cert } from './smartacme.classes.cert.js';
-import { CertManager } from './smartacme.classes.certmanager.js';
-import { CertMatcher } from './smartacme.classes.certmatcher.js';
+import { SmartacmeCert } from './smartacme.classes.cert.js';
+import { SmartacmeCertManager } from './smartacme.classes.certmanager.js';
+import { SmartacmeCertMatcher } from './smartacme.classes.certmatcher.js';
+import { commitinfo } from './00_commitinfo_data.js';
 
 /**
  * the options for the class @see SmartAcme
@@ -10,9 +11,30 @@ export interface ISmartAcmeOptions {
   accountPrivateKey?: string;
   accountEmail: string;
   mongoDescriptor: plugins.smartdata.IMongoDescriptor;
-  setChallenge: (dnsChallengeArg: plugins.tsclass.network.IDnsChallenge) => Promise<any>;
-  removeChallenge: (dnsChallengeArg: plugins.tsclass.network.IDnsChallenge) => Promise<any>;
+  // Removed legacy setChallenge/removeChallenge in favor of `challengeHandlers`
   environment: 'production' | 'integration';
+  /**
+   * Optional retry/backoff configuration for transient failures
+   */
+  retryOptions?: {
+    /** number of retry attempts */
+    retries?: number;
+    /** backoff multiplier */
+    factor?: number;
+    /** initial delay in milliseconds */
+    minTimeoutMs?: number;
+    /** maximum delay cap in milliseconds */
+    maxTimeoutMs?: number;
+  };
+  /**
+   * Pluggable ACME challenge handlers (DNS-01, HTTP-01, TLS-ALPN-01, etc.)
+   */
+  challengeHandlers?: plugins.handlers.IChallengeHandler<any>[];
+  /**
+   * Order of challenge types to try (e.g. ['http-01','dns-01']).
+   * Defaults to ['dns-01'] or first supported type from handlers.
+   */
+  challengePriority?: string[];
 }
 
 /**
@@ -29,46 +51,70 @@ export class SmartAcme {
   private options: ISmartAcmeOptions;
 
   // the acme client
-  private client: any;
-  private smartdns = new plugins.smartdns.Smartdns({});
-  public logger: plugins.smartlog.ConsoleLog;
+  private client: plugins.acme.Client;
+  private smartdns = new plugins.smartdnsClient.Smartdns({});
+  public logger: plugins.smartlog.Smartlog;
 
   // the account private key
   private privateKey: string;
 
-  // challenge fullfillment
-  private setChallenge: (dnsChallengeArg: plugins.tsclass.network.IDnsChallenge) => Promise<any>;
-  private removeChallenge: (dnsChallengeArg: plugins.tsclass.network.IDnsChallenge) => Promise<any>;
 
   // certmanager
-  private certmanager: CertManager;
-  private certmatcher: CertMatcher;
+  private certmanager: SmartacmeCertManager;
+  private certmatcher: SmartacmeCertMatcher;
+  // retry/backoff configuration (resolved with defaults)
+  private retryOptions: { retries: number; factor: number; minTimeoutMs: number; maxTimeoutMs: number };
+  // track pending DNS challenges for graceful shutdown
+  private pendingChallenges: plugins.tsclass.network.IDnsChallenge[] = [];
+  // configured pluggable ACME challenge handlers
+  private challengeHandlers: plugins.handlers.IChallengeHandler<any>[];
+  // priority order of challenge types
+  private challengePriority: string[];
 
   constructor(optionsArg: ISmartAcmeOptions) {
     this.options = optionsArg;
-    this.logger = new plugins.smartlog.ConsoleLog();
+    this.logger = plugins.smartlog.Smartlog.createForCommitinfo(commitinfo);
+    // enable console output for structured logging
+    this.logger.enableConsole();
+    // initialize retry/backoff options
+    this.retryOptions = {
+      retries: optionsArg.retryOptions?.retries ?? 3,
+      factor: optionsArg.retryOptions?.factor ?? 2,
+      minTimeoutMs: optionsArg.retryOptions?.minTimeoutMs ?? 1000,
+      maxTimeoutMs: optionsArg.retryOptions?.maxTimeoutMs ?? 30000,
+    };
+    // initialize challenge handlers (must provide at least one)
+    if (!optionsArg.challengeHandlers || optionsArg.challengeHandlers.length === 0) {
+      throw new Error(
+        'You must provide at least one ACME challenge handler via options.challengeHandlers',
+      );
+    }
+    this.challengeHandlers = optionsArg.challengeHandlers;
+    // initialize challenge priority
+    this.challengePriority =
+      optionsArg.challengePriority && optionsArg.challengePriority.length > 0
+        ? optionsArg.challengePriority
+        : this.challengeHandlers.map((h) => h.getSupportedTypes()[0]);
   }
 
   /**
-   * inits the instance
+   * starts the instance
    * ```ts
-   * await myCloudlyInstance.init() // does not support options
+   * await myCloudlyInstance.start() // does not support options
    * ```
    */
-  public async init() {
+  public async start() {
     this.privateKey =
       this.options.accountPrivateKey || (await plugins.acme.forge.createPrivateKey()).toString();
-    this.setChallenge = this.options.setChallenge;
-    this.removeChallenge = this.options.removeChallenge;
 
     // CertMangaer
-    this.certmanager = new CertManager(this, {
+    this.certmanager = new SmartacmeCertManager(this, {
       mongoDescriptor: this.options.mongoDescriptor,
     });
     await this.certmanager.init();
 
     // CertMatcher
-    this.certmatcher = new CertMatcher();
+    this.certmatcher = new SmartacmeCertMatcher();
 
     // ACME Client
     this.client = new plugins.acme.Client({
@@ -87,11 +133,65 @@ export class SmartAcme {
       termsOfServiceAgreed: true,
       contact: [`mailto:${this.options.accountEmail}`],
     });
+    // Setup graceful shutdown handlers
+    process.on('SIGINT', () => this.handleSignal('SIGINT'));
+    process.on('SIGTERM', () => this.handleSignal('SIGTERM'));
   }
 
-  public async stop() {
-    await this.certmanager.smartdataDb.close();
-  }
+    public async stop() {
+      await this.certmanager.smartdataDb.close();
+    }
+    /** Retry helper with exponential backoff */
+    private async retry<T>(operation: () => Promise<T>, operationName: string = 'operation'): Promise<T> {
+      let attempt = 0;
+      let delay = this.retryOptions.minTimeoutMs;
+      while (true) {
+        try {
+          return await operation();
+        } catch (err) {
+          attempt++;
+          if (attempt > this.retryOptions.retries) {
+            await this.logger.log('error', `Operation ${operationName} failed after ${attempt} attempts`, err);
+            throw err;
+          }
+          await this.logger.log('warn', `Operation ${operationName} failed on attempt ${attempt}, retrying in ${delay}ms`, err);
+          await plugins.smartdelay.delayFor(delay);
+          delay = Math.min(delay * this.retryOptions.factor, this.retryOptions.maxTimeoutMs);
+        }
+      }
+    }
+    /** Clean up pending challenges and shut down */
+    private async handleShutdown(): Promise<void> {
+      for (const input of [...this.pendingChallenges]) {
+        const type: string = (input as any).type;
+        const handler = this.challengeHandlers.find((h) => h.getSupportedTypes().includes(type));
+        if (handler) {
+          try {
+            await handler.cleanup(input);
+            await this.logger.log('info', `Removed pending ${type} challenge during shutdown`, input);
+          } catch (err) {
+            await this.logger.log('error', `Failed to remove pending ${type} challenge during shutdown`, err);
+          }
+        } else {
+          await this.logger.log(
+            'warn',
+            `No handler for pending challenge type '${type}' during shutdown; skipping cleanup`,
+            input,
+          );
+        }
+      }
+      this.pendingChallenges = [];
+      await this.stop();
+    }
+    /** Handle process signals for graceful shutdown */
+    private handleSignal(sig: string): void {
+      this.logger.log('info', `Received signal ${sig}, shutting down gracefully`);
+      this.handleShutdown()
+        .then(() => process.exit(0))
+        .catch((err) => {
+          this.logger.log('error', 'Error during shutdown', err).then(() => process.exit(1));
+        });
+    }
 
   /**
    * gets a certificate
@@ -107,7 +207,7 @@ export class SmartAcme {
    *
    * @param domainArg
    */
-  public async getCertificateForDomain(domainArg: string): Promise<Cert> {
+  public async getCertificateForDomain(domainArg: string): Promise<SmartacmeCert> {
     const certDomainName = this.certmatcher.getCertificateDomainNameByDomainName(domainArg);
     const retrievedCertificate = await this.certmanager.retrieveCertificate(certDomainName);
 
@@ -127,54 +227,71 @@ export class SmartAcme {
     // lets make sure others get the same interest
     const currentDomainInterst = await this.certmanager.interestMap.addInterest(certDomainName);
 
-    /* Place new order */
-    const order = await this.client.createOrder({
+    /* Place new order with retry */
+    const order = await this.retry(() => this.client.createOrder({
       identifiers: [
         { type: 'dns', value: certDomainName },
         { type: 'dns', value: `*.${certDomainName}` },
       ],
-    });
+    }), 'createOrder');
 
     /* Get authorizations and select challenges */
-    const authorizations = await this.client.getAuthorizations(order);
+    const authorizations = await this.retry(() => this.client.getAuthorizations(order), 'getAuthorizations');
 
     for (const authz of authorizations) {
-      console.log(authz);
-      const fullHostName: string = `_acme-challenge.${authz.identifier.value}`;
-      const dnsChallenge: string = authz.challenges.find((challengeArg) => {
-        return challengeArg.type === 'dns-01';
-      });
-      // process.exit(1);
-      const keyAuthorization: string = await this.client.getChallengeKeyAuthorization(dnsChallenge);
-
+      await this.logger.log('debug', 'Authorization received', authz);
+      // select a handler based on configured priority
+      let selectedHandler: { type: string; handler: plugins.handlers.IChallengeHandler<any> } | null = null;
+      let selectedChallengeArg: any = null;
+      for (const type of this.challengePriority) {
+        const candidate = authz.challenges.find((c: any) => c.type === type);
+        if (!candidate) continue;
+        const handler = this.challengeHandlers.find((h) => h.getSupportedTypes().includes(type));
+        if (handler) {
+          selectedHandler = { type, handler };
+          selectedChallengeArg = candidate;
+          break;
+        }
+      }
+      if (!selectedHandler) {
+        throw new Error(`No challenge handler for domain ${authz.identifier.value}: supported types [${this.challengePriority.join(',')}]`);
+      }
+      const { type, handler } = selectedHandler;
+      // build handler input with keyAuthorization
+      let input: any;
+      // retrieve keyAuthorization for challenge
+      const keyAuth = await this.client.getChallengeKeyAuthorization(selectedChallengeArg);
+      if (type === 'dns-01') {
+        input = { type, hostName: `_acme-challenge.${authz.identifier.value}`, challenge: keyAuth };
+      } else if (type === 'http-01') {
+        // HTTP-01 requires serving token at webPath
+        input = {
+          type,
+          token: (selectedChallengeArg as any).token,
+          keyAuthorization: keyAuth,
+          webPath: `/.well-known/acme-challenge/${(selectedChallengeArg as any).token}`,
+        };
+      } else {
+        // generic challenge input: include raw challenge properties
+        input = { type, keyAuthorization: keyAuth, ...selectedChallengeArg };
+      }
+      this.pendingChallenges.push(input);
       try {
-        /* Satisfy challenge */
-        await this.setChallenge({
-          hostName: fullHostName,
-          challenge: keyAuthorization,
-        });
-        await plugins.smartdelay.delayFor(30000);
-        await this.smartdns.checkUntilAvailable(fullHostName, 'TXT', keyAuthorization, 100, 5000);
-        console.log('Cool down an extra 60 second for region availability');
-        await plugins.smartdelay.delayFor(60000);
-
-        /* Verify that challenge is satisfied */
-        await this.client.verifyChallenge(authz, dnsChallenge);
-
-        /* Notify ACME provider that challenge is satisfied */
-        await this.client.completeChallenge(dnsChallenge);
-
-        /* Wait for ACME provider to respond with valid status */
-        await this.client.waitForValidStatus(dnsChallenge);
+        await this.retry(() => handler.prepare(input), `${type}.prepare`);
+        if (handler.verify) {
+          await this.retry(() => handler.verify!(input), `${type}.verify`);
+        } else {
+          await this.retry(() => this.client.verifyChallenge(authz, selectedChallengeArg), `${type}.verifyChallenge`);
+        }
+        await this.retry(() => this.client.completeChallenge(selectedChallengeArg), `${type}.completeChallenge`);
+        await this.retry(() => this.client.waitForValidStatus(selectedChallengeArg), `${type}.waitForValidStatus`);
       } finally {
-        /* Clean up challenge response */
         try {
-          await this.removeChallenge({
-            hostName: fullHostName,
-            challenge: keyAuthorization,
-          });
-        } catch (e) {
-          console.log(e);
+          await this.retry(() => handler.cleanup(input), `${type}.cleanup`);
+        } catch (err) {
+          await this.logger.log('error', `Error during ${type}.cleanup`, err);
+        } finally {
+          this.pendingChallenges = this.pendingChallenges.filter((c) => c !== input);
         }
       }
     }
@@ -185,8 +302,8 @@ export class SmartAcme {
       altNames: [certDomainName],
     });
 
-    await this.client.finalizeOrder(order, csr);
-    const cert = await this.client.getCertificate(order);
+    await this.retry(() => this.client.finalizeOrder(order, csr), 'finalizeOrder');
+    const cert = await this.retry(() => this.client.getCertificate(order), 'getCertificate');
 
     /* Done */
 
@@ -209,4 +326,8 @@ export class SmartAcme {
     currentDomainInterst.destroy();
     return newCertificate;
   }
+
+  public async getAllCertificates(): Promise<SmartacmeCert[]> {
+    return SmartacmeCert.getInstances({});
+  }
 }

package/ts/smartacme.plugins.ts

@@ -7,7 +7,7 @@ export { typedserver };
 import * as lik from '@push.rocks/lik';
 import * as smartdata from '@push.rocks/smartdata';
 import * as smartdelay from '@push.rocks/smartdelay';
-import * as smartdns from '@push.rocks/smartdns';
+import * as smartdnsClient from '@push.rocks/smartdns/client';
 import * as smartlog from '@push.rocks/smartlog';
 import * as smartpromise from '@push.rocks/smartpromise';
 import * as smartrequest from '@push.rocks/smartrequest';
@@ -19,7 +19,7 @@ export {
   lik,
   smartdata,
   smartdelay,
-  smartdns,
+  smartdnsClient,
   smartlog,
   smartpromise,
   smartrequest,
@@ -37,3 +37,6 @@ export { tsclass };
 import * as acme from 'acme-client';
 
 export { acme };
+// local handlers for challenge types
+import * as handlers from './handlers/index.js';
+export { handlers };