@push.rocks/smartacme 9.1.2 → 9.2.0

package/ts_server/server.handlers.challenge.ts

@@ -0,0 +1,142 @@
+import type * as http from 'node:http';
+import * as crypto from 'node:crypto';
+import { AcmeCrypto } from '../ts/acme/acme.classes.crypto.js';
+import type { JwsVerifier } from './server.classes.jws.verifier.js';
+import { AcmeServerError } from './server.classes.jws.verifier.js';
+import type { IServerOrderStore, IServerAccountStore } from './server.interfaces.js';
+import type { ChallengeVerifier } from './server.classes.challenge.verifier.js';
+
+/**
+ * POST /challenge/:id — Trigger or poll an ACME challenge.
+ * - POST with `{}` payload: trigger challenge validation
+ * - POST-as-GET (null payload): return current challenge state
+ */
+export function createChallengeHandler(
+  baseUrl: string,
+  jwsVerifier: JwsVerifier,
+  orderStore: IServerOrderStore,
+  accountStore: IServerAccountStore,
+  challengeVerifier: ChallengeVerifier,
+) {
+  return async (
+    req: http.IncomingMessage,
+    res: http.ServerResponse,
+    params: Record<string, string>,
+    body: any,
+  ): Promise<void> => {
+    const challengeId = params.id;
+    const requestUrl = `${baseUrl}/challenge/${challengeId}`;
+    const verified = await jwsVerifier.verify(body, requestUrl);
+
+    const challenge = await orderStore.getChallenge(challengeId);
+    if (!challenge) {
+      throw new AcmeServerError(404, 'urn:ietf:params:acme:error:malformed', 'Challenge not found');
+    }
+
+    // POST-as-GET: just return current state
+    if (verified.payload === null) {
+      sendChallengeResponse(res, challenge, baseUrl);
+      return;
+    }
+
+    // Trigger validation (payload should be `{}`)
+    if (challenge.status !== 'pending') {
+      // Already processing or completed
+      sendChallengeResponse(res, challenge, baseUrl);
+      return;
+    }
+
+    // Set to processing
+    await orderStore.updateChallenge(challengeId, { status: 'processing' });
+
+    // Get the authorization to find the domain
+    const authz = await orderStore.getAuthorization(challenge.authorizationId);
+    if (!authz) {
+      throw new AcmeServerError(500, 'urn:ietf:params:acme:error:serverInternal', 'Authorization not found');
+    }
+
+    // Resolve the account's JWK for key authorization computation
+    const account = await accountStore.getByUrl(verified.kid!);
+    if (!account) {
+      throw new AcmeServerError(400, 'urn:ietf:params:acme:error:accountDoesNotExist', 'Account not found');
+    }
+
+    const thumbprint = AcmeCrypto.getJwkThumbprint(account.jwk);
+    const keyAuth = `${challenge.token}.${thumbprint}`;
+
+    // Verify the challenge
+    let valid = false;
+    const domain = authz.identifier.value;
+
+    if (challenge.type === 'http-01') {
+      valid = await challengeVerifier.verifyHttp01(domain, challenge.token, keyAuth);
+    } else if (challenge.type === 'dns-01') {
+      const hash = crypto.createHash('sha256').update(keyAuth).digest('base64url');
+      valid = await challengeVerifier.verifyDns01(domain, hash);
+    }
+
+    if (valid) {
+      await orderStore.updateChallenge(challengeId, {
+        status: 'valid',
+        validated: new Date().toISOString(),
+      });
+      challenge.status = 'valid';
+      challenge.validated = new Date().toISOString();
+
+      // Check if all challenges for this authorization's required type are valid
+      // One valid challenge is enough to validate the authorization
+      await orderStore.updateAuthorization(authz.id, { status: 'valid' });
+
+      // Check if all authorizations for the order are now valid
+      const order = await orderStore.getOrder(authz.orderId);
+      if (order && order.status === 'pending') {
+        let allValid = true;
+        for (const authzId of order.authorizationIds) {
+          const a = await orderStore.getAuthorization(authzId);
+          if (!a || a.status !== 'valid') {
+            allValid = false;
+            break;
+          }
+        }
+        if (allValid) {
+          await orderStore.updateOrder(order.id, { status: 'ready' });
+        }
+      }
+    } else {
+      await orderStore.updateChallenge(challengeId, {
+        status: 'invalid',
+        error: {
+          type: 'urn:ietf:params:acme:error:incorrectResponse',
+          detail: `Challenge verification failed for ${domain}`,
+        },
+      });
+      challenge.status = 'invalid';
+
+      // Mark authorization as invalid too
+      await orderStore.updateAuthorization(authz.id, { status: 'invalid' });
+    }
+
+    sendChallengeResponse(res, challenge, baseUrl);
+  };
+}
+
+function sendChallengeResponse(
+  res: http.ServerResponse,
+  challenge: { id: string; type: string; status: string; token: string; validated?: string },
+  baseUrl: string,
+): void {
+  const responseBody: Record<string, any> = {
+    type: challenge.type,
+    url: `${baseUrl}/challenge/${challenge.id}`,
+    status: challenge.status,
+    token: challenge.token,
+  };
+  if (challenge.validated) {
+    responseBody.validated = challenge.validated;
+  }
+  res.writeHead(200, {
+    'Content-Type': 'application/json',
+    'Link': `<${baseUrl}/directory>;rel="index"`,
+  });
+  res.end(JSON.stringify(responseBody));
+}

package/ts_server/server.handlers.directory.ts

@@ -0,0 +1,30 @@
+import type * as http from 'node:http';
+import type { IAcmeDirectory } from '../ts/acme/acme.interfaces.js';
+
+/**
+ * GET /directory — Returns the ACME directory object with all endpoint URLs.
+ */
+export function createDirectoryHandler(baseUrl: string) {
+  return async (
+    _req: http.IncomingMessage,
+    res: http.ServerResponse,
+    _params: Record<string, string>,
+    _body: any,
+  ): Promise<void> => {
+    const directory: IAcmeDirectory = {
+      newNonce: `${baseUrl}/new-nonce`,
+      newAccount: `${baseUrl}/new-account`,
+      newOrder: `${baseUrl}/new-order`,
+      revokeCert: `${baseUrl}/revoke-cert`,
+      keyChange: `${baseUrl}/key-change`,
+      meta: {
+        termsOfService: `${baseUrl}/terms`,
+        website: `${baseUrl}`,
+        caaIdentities: [],
+        externalAccountRequired: false,
+      },
+    };
+    res.writeHead(200, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify(directory));
+  };
+}

package/ts_server/server.handlers.finalize.ts

@@ -0,0 +1,93 @@
+import type * as http from 'node:http';
+import type { JwsVerifier } from './server.classes.jws.verifier.js';
+import { AcmeServerError } from './server.classes.jws.verifier.js';
+import type { IServerOrderStore } from './server.interfaces.js';
+import type { AcmeServerCA } from './server.classes.ca.js';
+
+/**
+ * POST /finalize/:id — Submit CSR and issue certificate.
+ */
+export function createFinalizeHandler(
+  baseUrl: string,
+  jwsVerifier: JwsVerifier,
+  orderStore: IServerOrderStore,
+  ca: AcmeServerCA,
+) {
+  return async (
+    req: http.IncomingMessage,
+    res: http.ServerResponse,
+    params: Record<string, string>,
+    body: any,
+  ): Promise<void> => {
+    const orderId = params.id;
+    const requestUrl = `${baseUrl}/finalize/${orderId}`;
+    const verified = await jwsVerifier.verify(body, requestUrl);
+
+    if (!verified.kid) {
+      throw new AcmeServerError(400, 'urn:ietf:params:acme:error:malformed', 'Finalize requires kid');
+    }
+
+    const order = await orderStore.getOrder(orderId);
+    if (!order) {
+      throw new AcmeServerError(404, 'urn:ietf:params:acme:error:malformed', 'Order not found');
+    }
+
+    // Check all authorizations are valid and update order status if needed
+    if (order.status === 'pending') {
+      let allValid = true;
+      for (const authzId of order.authorizationIds) {
+        const authz = await orderStore.getAuthorization(authzId);
+        if (!authz || authz.status !== 'valid') {
+          allValid = false;
+          break;
+        }
+      }
+      if (allValid) {
+        await orderStore.updateOrder(orderId, { status: 'ready' });
+        order.status = 'ready';
+      }
+    }
+
+    if (order.status !== 'ready') {
+      throw new AcmeServerError(
+        403,
+        'urn:ietf:params:acme:error:orderNotReady',
+        `Order is in "${order.status}" state, expected "ready"`,
+      );
+    }
+
+    const { payload } = verified;
+    if (!payload?.csr) {
+      throw new AcmeServerError(400, 'urn:ietf:params:acme:error:malformed', 'Missing CSR in finalize request');
+    }
+
+    // Transition to processing
+    await orderStore.updateOrder(orderId, { status: 'processing' });
+
+    // Sign the certificate
+    const certPem = await ca.signCsr(payload.csr);
+
+    // Store certificate and update order
+    const certUrl = `${baseUrl}/cert/${orderId}`;
+    await orderStore.storeCertPem(orderId, certPem);
+    await orderStore.updateOrder(orderId, {
+      status: 'valid',
+      certificate: certUrl,
+    });
+
+    const responseBody = {
+      status: 'valid',
+      expires: order.expires,
+      identifiers: order.identifiers,
+      authorizations: order.authorizationIds.map((id) => `${baseUrl}/authz/${id}`),
+      finalize: order.finalize,
+      certificate: certUrl,
+    };
+
+    res.writeHead(200, {
+      'Content-Type': 'application/json',
+      'Location': `${baseUrl}/order/${orderId}`,
+    });
+    res.end(JSON.stringify(responseBody));
+  };
+}

package/ts_server/server.handlers.nonce.ts

@@ -0,0 +1,29 @@
+import type * as http from 'node:http';
+
+/**
+ * HEAD /new-nonce — Returns 200 with Replay-Nonce header (added by router).
+ * GET  /new-nonce — Returns 204 with Replay-Nonce header (added by router).
+ */
+export function createNonceHeadHandler() {
+  return async (
+    _req: http.IncomingMessage,
+    res: http.ServerResponse,
+    _params: Record<string, string>,
+    _body: any,
+  ): Promise<void> => {
+    res.writeHead(200, { 'Content-Type': 'application/octet-stream' });
+    res.end();
+  };
+}
+
+export function createNonceGetHandler() {
+  return async (
+    _req: http.IncomingMessage,
+    res: http.ServerResponse,
+    _params: Record<string, string>,
+    _body: any,
+  ): Promise<void> => {
+    res.writeHead(204);
+    res.end();
+  };
+}

package/ts_server/server.handlers.order.ts

@@ -0,0 +1,177 @@
+import type * as http from 'node:http';
+import * as crypto from 'node:crypto';
+import type { JwsVerifier } from './server.classes.jws.verifier.js';
+import { AcmeServerError } from './server.classes.jws.verifier.js';
+import type { IServerOrderStore, IServerAccountStore } from './server.interfaces.js';
+import type { IAcmeIdentifier } from '../ts/acme/acme.interfaces.js';
+
+/**
+ * POST /new-order — Create a new ACME order.
+ */
+export function createNewOrderHandler(
+  baseUrl: string,
+  jwsVerifier: JwsVerifier,
+  orderStore: IServerOrderStore,
+) {
+  return async (
+    req: http.IncomingMessage,
+    res: http.ServerResponse,
+    _params: Record<string, string>,
+    body: any,
+  ): Promise<void> => {
+    const requestUrl = `${baseUrl}/new-order`;
+    const verified = await jwsVerifier.verify(body, requestUrl);
+
+    if (!verified.kid) {
+      throw new AcmeServerError(400, 'urn:ietf:params:acme:error:malformed', 'newOrder requires kid');
+    }
+
+    const { payload } = verified;
+    const identifiers: IAcmeIdentifier[] = payload?.identifiers;
+
+    if (!identifiers || !Array.isArray(identifiers) || identifiers.length === 0) {
+      throw new AcmeServerError(
+        400,
+        'urn:ietf:params:acme:error:malformed',
+        'Order must include at least one identifier',
+      );
+    }
+
+    const orderId = crypto.randomBytes(16).toString('hex');
+    const expires = new Date();
+    expires.setDate(expires.getDate() + 7);
+
+    // Create authorizations and challenges for each identifier
+    const authorizationIds: string[] = [];
+
+    for (const identifier of identifiers) {
+      const authzId = crypto.randomBytes(16).toString('hex');
+      const isWildcard = identifier.value.startsWith('*.');
+      const domain = isWildcard ? identifier.value.slice(2) : identifier.value;
+
+      // Create challenges for this authorization
+      const challengeIds: string[] = [];
+
+      // HTTP-01 challenge (not for wildcards)
+      if (!isWildcard) {
+        const http01Id = crypto.randomBytes(16).toString('hex');
+        const http01Token = crypto.randomBytes(32).toString('base64url');
+        await orderStore.createChallenge({
+          id: http01Id,
+          authorizationId: authzId,
+          type: 'http-01',
+          token: http01Token,
+          status: 'pending',
+        });
+        challengeIds.push(http01Id);
+      }
+
+      // DNS-01 challenge (always)
+      const dns01Id = crypto.randomBytes(16).toString('hex');
+      const dns01Token = crypto.randomBytes(32).toString('base64url');
+      await orderStore.createChallenge({
+        id: dns01Id,
+        authorizationId: authzId,
+        type: 'dns-01',
+        token: dns01Token,
+        status: 'pending',
+      });
+      challengeIds.push(dns01Id);
+
+      await orderStore.createAuthorization({
+        id: authzId,
+        orderId,
+        identifier: { type: 'dns', value: domain },
+        status: 'pending',
+        expires: expires.toISOString(),
+        challengeIds,
+        wildcard: isWildcard || undefined,
+      });
+
+      authorizationIds.push(authzId);
+    }
+
+    const order = await orderStore.createOrder({
+      id: orderId,
+      accountUrl: verified.kid,
+      status: 'pending',
+      identifiers,
+      authorizationIds,
+      expires: expires.toISOString(),
+      finalize: `${baseUrl}/finalize/${orderId}`,
+    });
+
+    const responseBody = {
+      status: order.status,
+      expires: order.expires,
+      identifiers: order.identifiers,
+      authorizations: order.authorizationIds.map((id) => `${baseUrl}/authz/${id}`),
+      finalize: order.finalize,
+    };
+
+    res.writeHead(201, {
+      'Content-Type': 'application/json',
+      'Location': `${baseUrl}/order/${orderId}`,
+    });
+    res.end(JSON.stringify(responseBody));
+  };
+}
+
+/**
+ * POST /order/:id — Poll order status (POST-as-GET).
+ */
+export function createOrderPollHandler(
+  baseUrl: string,
+  jwsVerifier: JwsVerifier,
+  orderStore: IServerOrderStore,
+) {
+  return async (
+    req: http.IncomingMessage,
+    res: http.ServerResponse,
+    params: Record<string, string>,
+    body: any,
+  ): Promise<void> => {
+    const orderId = params.id;
+    const requestUrl = `${baseUrl}/order/${orderId}`;
+    await jwsVerifier.verify(body, requestUrl);
+
+    const order = await orderStore.getOrder(orderId);
+    if (!order) {
+      throw new AcmeServerError(404, 'urn:ietf:params:acme:error:malformed', 'Order not found');
+    }
+
+    // Check if all authorizations are valid → transition to ready
+    if (order.status === 'pending') {
+      let allValid = true;
+      for (const authzId of order.authorizationIds) {
+        const authz = await orderStore.getAuthorization(authzId);
+        if (!authz || authz.status !== 'valid') {
+          allValid = false;
+          break;
+        }
+      }
+      if (allValid) {
+        await orderStore.updateOrder(orderId, { status: 'ready' });
+        order.status = 'ready';
+      }
+    }
+
+    const responseBody: Record<string, any> = {
+      status: order.status,
+      expires: order.expires,
+      identifiers: order.identifiers,
+      authorizations: order.authorizationIds.map((id) => `${baseUrl}/authz/${id}`),
+      finalize: order.finalize,
+    };
+
+    if (order.certificate) {
+      responseBody.certificate = order.certificate;
+    }
+
+    res.writeHead(200, {
+      'Content-Type': 'application/json',
+      'Location': requestUrl,
+    });
+    res.end(JSON.stringify(responseBody));
+  };
+}

package/ts_server/server.interfaces.ts

@@ -0,0 +1,98 @@
+import type { IAcmeIdentifier } from '../ts/acme/acme.interfaces.js';
+
+// ============================================================================
+// Server configuration
+// ============================================================================
+
+export interface IAcmeServerOptions {
+  port?: number;
+  hostname?: string;
+  baseUrl?: string;
+  /** When false, challenges auto-approve on trigger (useful for testing) */
+  challengeVerification?: boolean;
+  caOptions?: {
+    commonName?: string;
+    validityDays?: number;
+    certValidityDays?: number;
+  };
+}
+
+// ============================================================================
+// Pluggable storage interfaces
+// ============================================================================
+
+export interface IServerAccountStore {
+  create(account: IServerAccount): Promise<IServerAccount>;
+  getByThumbprint(thumbprint: string): Promise<IServerAccount | null>;
+  getByUrl(url: string): Promise<IServerAccount | null>;
+}
+
+export interface IServerOrderStore {
+  createOrder(order: IServerOrder): Promise<IServerOrder>;
+  getOrder(id: string): Promise<IServerOrder | null>;
+  updateOrder(id: string, updates: Partial<IServerOrder>): Promise<void>;
+  createAuthorization(authz: IServerAuthorization): Promise<IServerAuthorization>;
+  getAuthorization(id: string): Promise<IServerAuthorization | null>;
+  updateAuthorization(id: string, updates: Partial<IServerAuthorization>): Promise<void>;
+  createChallenge(challenge: IServerChallenge): Promise<IServerChallenge>;
+  getChallenge(id: string): Promise<IServerChallenge | null>;
+  updateChallenge(id: string, updates: Partial<IServerChallenge>): Promise<void>;
+  storeCertPem(orderId: string, pem: string): Promise<void>;
+  getCertPem(orderId: string): Promise<string | null>;
+}
+
+// ============================================================================
+// Internal server models
+// ============================================================================
+
+export interface IServerAccount {
+  id: string;
+  thumbprint: string;
+  url: string;
+  jwk: Record<string, string>;
+  status: string;
+  contact: string[];
+  createdAt: string;
+}
+
+export interface IServerOrder {
+  id: string;
+  accountUrl: string;
+  status: string;
+  identifiers: IAcmeIdentifier[];
+  authorizationIds: string[];
+  expires: string;
+  finalize: string;
+  certificate?: string;
+}
+
+export interface IServerAuthorization {
+  id: string;
+  orderId: string;
+  identifier: IAcmeIdentifier;
+  status: string;
+  expires: string;
+  challengeIds: string[];
+  wildcard?: boolean;
+}
+
+export interface IServerChallenge {
+  id: string;
+  authorizationId: string;
+  type: string;
+  token: string;
+  status: string;
+  validated?: string;
+  error?: { type: string; detail: string };
+}
+
+// ============================================================================
+// Route handler type
+// ============================================================================
+
+export type TRouteHandler = (
+  req: import('node:http').IncomingMessage,
+  res: import('node:http').ServerResponse,
+  params: Record<string, string>,
+  body: any,
+) => Promise<void>;