@push.rocks/smartacme 9.1.3 → 9.3.0

package/ts_server/server.classes.acmeserver.ts

@@ -0,0 +1,128 @@
+import * as http from 'node:http';
+import type { IAcmeServerOptions } from './server.interfaces.js';
+import { NonceManager } from './server.classes.nonce.js';
+import { JwsVerifier } from './server.classes.jws.verifier.js';
+import { MemoryAccountStore } from './server.classes.account.store.js';
+import { MemoryOrderStore } from './server.classes.order.store.js';
+import { AcmeServerCA } from './server.classes.ca.js';
+import { ChallengeVerifier } from './server.classes.challenge.verifier.js';
+import { AcmeRouter } from './server.classes.router.js';
+import { createDirectoryHandler } from './server.handlers.directory.js';
+import { createNonceHeadHandler, createNonceGetHandler } from './server.handlers.nonce.js';
+import { createAccountHandler } from './server.handlers.account.js';
+import { createNewOrderHandler, createOrderPollHandler } from './server.handlers.order.js';
+import { createAuthzHandler } from './server.handlers.authz.js';
+import { createChallengeHandler } from './server.handlers.challenge.js';
+import { createFinalizeHandler } from './server.handlers.finalize.js';
+import { createCertHandler } from './server.handlers.cert.js';
+
+/**
+ * ACME Directory Server — a self-contained RFC 8555 Certificate Authority.
+ *
+ * Usage:
+ * ```ts
+ * const server = new AcmeServer({ port: 14000 });
+ * await server.start();
+ * console.log(server.getDirectoryUrl()); // http://localhost:14000/directory
+ * ```
+ */
+export class AcmeServer {
+  private options: Required<Pick<IAcmeServerOptions, 'port' | 'hostname'>> & IAcmeServerOptions;
+  private httpServer: http.Server | null = null;
+  private ca: AcmeServerCA;
+  private baseUrl: string;
+
+  constructor(options: IAcmeServerOptions = {}) {
+    this.options = {
+      port: options.port ?? 14000,
+      hostname: options.hostname ?? '0.0.0.0',
+      ...options,
+    };
+    this.baseUrl = options.baseUrl ?? `http://localhost:${this.options.port}`;
+    this.ca = new AcmeServerCA(options.caOptions);
+  }
+
+  async start(): Promise<void> {
+    // Initialize CA
+    await this.ca.init();
+
+    // Create stores
+    const accountStore = new MemoryAccountStore();
+    const orderStore = new MemoryOrderStore();
+
+    // Create managers
+    const nonceManager = new NonceManager();
+    const jwsVerifier = new JwsVerifier(nonceManager, accountStore);
+    const challengeVerifier = new ChallengeVerifier(this.options.challengeVerification ?? true);
+
+    // Create router and register routes
+    const router = new AcmeRouter(nonceManager);
+
+    // Directory
+    router.addRoute('GET', '/directory', createDirectoryHandler(this.baseUrl));
+
+    // Nonce
+    router.addRoute('HEAD', '/new-nonce', createNonceHeadHandler());
+    router.addRoute('GET', '/new-nonce', createNonceGetHandler());
+
+    // Account
+    router.addRoute('POST', '/new-account', createAccountHandler(this.baseUrl, jwsVerifier, accountStore));
+
+    // Order
+    router.addRoute('POST', '/new-order', createNewOrderHandler(this.baseUrl, jwsVerifier, orderStore));
+    router.addRoute('POST', '/order/:id', createOrderPollHandler(this.baseUrl, jwsVerifier, orderStore));
+
+    // Authorization
+    router.addRoute('POST', '/authz/:id', createAuthzHandler(this.baseUrl, jwsVerifier, orderStore));
+
+    // Challenge
+    router.addRoute('POST', '/challenge/:id', createChallengeHandler(
+      this.baseUrl,
+      jwsVerifier,
+      orderStore,
+      accountStore,
+      challengeVerifier,
+    ));
+
+    // Finalize
+    router.addRoute('POST', '/finalize/:id', createFinalizeHandler(this.baseUrl, jwsVerifier, orderStore, this.ca));
+
+    // Certificate
+    router.addRoute('POST', '/cert/:id', createCertHandler(this.baseUrl, jwsVerifier, orderStore));
+
+    // Start HTTP server
+    this.httpServer = http.createServer((req, res) => {
+      router.handle(req, res).catch((err) => {
+        if (!res.headersSent) {
+          res.writeHead(500, { 'Content-Type': 'application/problem+json' });
+          res.end(JSON.stringify({
+            type: 'urn:ietf:params:acme:error:serverInternal',
+            detail: err instanceof Error ? err.message : 'Unknown error',
+            status: 500,
+          }));
+        }
+      });
+    });
+
+    await new Promise<void>((resolve) => {
+      this.httpServer!.listen(this.options.port, this.options.hostname, () => resolve());
+    });
+  }
+
+  async stop(): Promise<void> {
+    if (this.httpServer) {
+      await new Promise<void>((resolve, reject) => {
+        this.httpServer!.close((err) => (err ? reject(err) : resolve()));
+      });
+      this.httpServer = null;
+    }
+  }
+
+  getDirectoryUrl(): string {
+    return `${this.baseUrl}/directory`;
+  }
+
+  getCaCertPem(): string {
+    return this.ca.getCaCertPem();
+  }
+}

package/ts_server/server.classes.ca.ts

@@ -0,0 +1,142 @@
+import * as crypto from 'node:crypto';
+
+/**
+ * Certificate Authority for the ACME server.
+ * Generates a self-signed root CA and signs certificates from CSRs.
+ * Uses @peculiar/x509 (already a project dependency).
+ */
+export class AcmeServerCA {
+  private caKeyPair!: CryptoKeyPair;
+  private caCert!: InstanceType<typeof import('@peculiar/x509').X509Certificate>;
+  private caCertPem!: string;
+  private certValidityDays: number;
+
+  constructor(private options: { commonName?: string; validityDays?: number; certValidityDays?: number } = {}) {
+    this.certValidityDays = options.certValidityDays ?? 90;
+  }
+
+  async init(): Promise<void> {
+    const x509 = await import('@peculiar/x509');
+    const { webcrypto } = crypto;
+    x509.cryptoProvider.set(webcrypto as any);
+
+    // Generate RSA key pair for the CA
+    this.caKeyPair = await webcrypto.subtle.generateKey(
+      {
+        name: 'RSASSA-PKCS1-v1_5',
+        modulusLength: 2048,
+        publicExponent: new Uint8Array([1, 0, 1]),
+        hash: 'SHA-256',
+      },
+      true,
+      ['sign', 'verify'],
+    ) as CryptoKeyPair;
+
+    const cn = this.options.commonName ?? 'SmartACME Test CA';
+    const validityDays = this.options.validityDays ?? 3650;
+    const notBefore = new Date();
+    const notAfter = new Date();
+    notAfter.setDate(notAfter.getDate() + validityDays);
+
+    // Create self-signed root CA certificate
+    this.caCert = await x509.X509CertificateGenerator.createSelfSigned({
+      serialNumber: this.randomSerialNumber(),
+      name: `CN=${cn}`,
+      notBefore,
+      notAfter,
+      signingAlgorithm: { name: 'RSASSA-PKCS1-v1_5' },
+      keys: this.caKeyPair,
+      extensions: [
+        new x509.BasicConstraintsExtension(true, undefined, true),
+        new x509.KeyUsagesExtension(
+          x509.KeyUsageFlags.keyCertSign | x509.KeyUsageFlags.cRLSign,
+          true,
+        ),
+        await x509.SubjectKeyIdentifierExtension.create(this.caKeyPair.publicKey),
+      ],
+    });
+
+    this.caCertPem = this.caCert.toString('pem');
+  }
+
+  /**
+   * Sign a CSR and return a PEM certificate chain (end-entity + root CA).
+   * @param csrDerBase64url - The CSR in base64url-encoded DER format (as sent by ACME clients)
+   */
+  async signCsr(csrDerBase64url: string): Promise<string> {
+    const x509 = await import('@peculiar/x509');
+    const { webcrypto } = crypto;
+    x509.cryptoProvider.set(webcrypto as any);
+
+    // Parse the CSR
+    const csrDer = Buffer.from(csrDerBase64url, 'base64url');
+    const csr = new x509.Pkcs10CertificateRequest(csrDer);
+
+    // Extract Subject Alternative Names from CSR extensions
+    const sanNames: { type: 'dns'; value: string }[] = [];
+    const sanExt = csr.extensions?.find(
+      (ext) => ext.type === '2.5.29.17', // OID for SubjectAlternativeName
+    );
+
+    if (sanExt) {
+      const san = new x509.SubjectAlternativeNameExtension(sanExt.rawData);
+      if (san.names) {
+        const jsonNames = san.names.toJSON();
+        for (const name of jsonNames) {
+          if (name.type === 'dns') {
+            sanNames.push({ type: 'dns', value: name.value });
+          }
+        }
+      }
+    }
+
+    // If no SAN found, use CN from subject
+    if (sanNames.length === 0) {
+      const cnMatch = csr.subject.match(/CN=([^,]+)/);
+      if (cnMatch) {
+        sanNames.push({ type: 'dns', value: cnMatch[1] });
+      }
+    }
+
+    const notBefore = new Date();
+    const notAfter = new Date();
+    notAfter.setDate(notAfter.getDate() + this.certValidityDays);
+
+    // Sign the certificate
+    const cert = await x509.X509CertificateGenerator.create({
+      serialNumber: this.randomSerialNumber(),
+      subject: csr.subject,
+      issuer: this.caCert.subject,
+      notBefore,
+      notAfter,
+      signingAlgorithm: { name: 'RSASSA-PKCS1-v1_5' },
+      publicKey: csr.publicKey,
+      signingKey: this.caKeyPair.privateKey,
+      extensions: [
+        new x509.BasicConstraintsExtension(false, undefined, true),
+        new x509.KeyUsagesExtension(
+          x509.KeyUsageFlags.digitalSignature | x509.KeyUsageFlags.keyEncipherment,
+          true,
+        ),
+        new x509.ExtendedKeyUsageExtension(
+          ['1.3.6.1.5.5.7.3.1'], // serverAuth
+          true,
+        ),
+        new x509.SubjectAlternativeNameExtension(sanNames),
+        await x509.AuthorityKeyIdentifierExtension.create(this.caKeyPair.publicKey),
+      ],
+    });
+
+    // Return PEM chain: end-entity cert + root CA cert
+    const certPem = cert.toString('pem');
+    return `${certPem}\n${this.caCertPem}`;
+  }
+
+  getCaCertPem(): string {
+    return this.caCertPem;
+  }
+
+  private randomSerialNumber(): string {
+    return crypto.randomBytes(16).toString('hex');
+  }
+}

package/ts_server/server.classes.challenge.verifier.ts

@@ -0,0 +1,61 @@
+import * as http from 'node:http';
+
+/**
+ * Verifies ACME challenges by making HTTP requests or DNS lookups.
+ */
+export class ChallengeVerifier {
+  private verificationEnabled: boolean;
+
+  constructor(verificationEnabled = true) {
+    this.verificationEnabled = verificationEnabled;
+  }
+
+  /**
+   * Verify an HTTP-01 challenge by fetching the token from the domain.
+   */
+  async verifyHttp01(domain: string, token: string, expectedKeyAuth: string): Promise<boolean> {
+    if (!this.verificationEnabled) {
+      return true;
+    }
+
+    try {
+      const url = `http://${domain}/.well-known/acme-challenge/${token}`;
+      const body = await this.httpGet(url);
+      return body.trim() === expectedKeyAuth.trim();
+    } catch {
+      return false;
+    }
+  }
+
+  /**
+   * Verify a DNS-01 challenge by looking up the TXT record.
+   */
+  async verifyDns01(domain: string, expectedHash: string): Promise<boolean> {
+    if (!this.verificationEnabled) {
+      return true;
+    }
+
+    try {
+      const { promises: dns } = await import('node:dns');
+      const records = await dns.resolveTxt(`_acme-challenge.${domain}`);
+      const flatRecords = records.map((r) => r.join(''));
+      return flatRecords.some((r) => r === expectedHash);
+    } catch {
+      return false;
+    }
+  }
+
+  private httpGet(url: string): Promise<string> {
+    return new Promise((resolve, reject) => {
+      const req = http.get(url, { timeout: 10000 }, (res) => {
+        const chunks: Buffer[] = [];
+        res.on('data', (chunk: Buffer) => chunks.push(chunk));
+        res.on('end', () => resolve(Buffer.concat(chunks).toString('utf-8')));
+      });
+      req.on('error', reject);
+      req.on('timeout', () => {
+        req.destroy(new Error('HTTP-01 verification timeout'));
+      });
+    });
+  }
+}

package/ts_server/server.classes.jws.verifier.ts

@@ -0,0 +1,153 @@
+import * as crypto from 'node:crypto';
+import { AcmeCrypto } from '../ts/acme/acme.classes.crypto.js';
+import type { NonceManager } from './server.classes.nonce.js';
+import type { IServerAccountStore } from './server.interfaces.js';
+
+export interface IJwsVerifyResult {
+  jwk: Record<string, string>;
+  kid: string | null;
+  thumbprint: string;
+  payload: any;
+}
+
+/**
+ * Verifies JWS-signed ACME requests.
+ * This is the inverse of AcmeCrypto.createJws().
+ */
+export class JwsVerifier {
+  private nonceManager: NonceManager;
+  private accountStore: IServerAccountStore;
+
+  constructor(nonceManager: NonceManager, accountStore: IServerAccountStore) {
+    this.nonceManager = nonceManager;
+    this.accountStore = accountStore;
+  }
+
+  async verify(
+    body: { protected: string; payload: string; signature: string },
+    expectedUrl: string,
+  ): Promise<IJwsVerifyResult> {
+    if (!body || !body.protected || body.signature === undefined) {
+      throw new AcmeServerError(400, 'urn:ietf:params:acme:error:malformed', 'Invalid JWS structure');
+    }
+
+    // 1. Decode protected header
+    const headerJson = Buffer.from(body.protected, 'base64url').toString('utf-8');
+    let header: Record<string, any>;
+    try {
+      header = JSON.parse(headerJson);
+    } catch {
+      throw new AcmeServerError(400, 'urn:ietf:params:acme:error:malformed', 'Invalid JWS protected header');
+    }
+
+    // 2. Validate required fields
+    const { alg, nonce, url, jwk, kid } = header;
+    if (!alg) {
+      throw new AcmeServerError(400, 'urn:ietf:params:acme:error:malformed', 'Missing alg in protected header');
+    }
+    if (!nonce) {
+      throw new AcmeServerError(400, 'urn:ietf:params:acme:error:badNonce', 'Missing nonce in protected header');
+    }
+    if (!url) {
+      throw new AcmeServerError(400, 'urn:ietf:params:acme:error:malformed', 'Missing url in protected header');
+    }
+
+    // 3. Validate URL matches
+    if (url !== expectedUrl) {
+      throw new AcmeServerError(
+        400,
+        'urn:ietf:params:acme:error:malformed',
+        `URL mismatch: expected ${expectedUrl}, got ${url}`,
+      );
+    }
+
+    // 4. Validate and consume nonce
+    if (!this.nonceManager.consume(nonce)) {
+      throw new AcmeServerError(400, 'urn:ietf:params:acme:error:badNonce', 'Invalid or expired nonce');
+    }
+
+    // 5. Must have exactly one of jwk or kid
+    if (jwk && kid) {
+      throw new AcmeServerError(400, 'urn:ietf:params:acme:error:malformed', 'JWS must have jwk or kid, not both');
+    }
+    if (!jwk && !kid) {
+      throw new AcmeServerError(400, 'urn:ietf:params:acme:error:malformed', 'JWS must have jwk or kid');
+    }
+
+    // 6. Resolve the public key
+    let resolvedJwk: Record<string, string>;
+    if (jwk) {
+      resolvedJwk = jwk;
+    } else {
+      // Look up account by kid (account URL)
+      const account = await this.accountStore.getByUrl(kid);
+      if (!account) {
+        throw new AcmeServerError(
+          400,
+          'urn:ietf:params:acme:error:accountDoesNotExist',
+          'Account not found for kid',
+        );
+      }
+      resolvedJwk = account.jwk;
+    }
+
+    // 7. Reconstruct public key and verify signature
+    const publicKey = crypto.createPublicKey({ key: resolvedJwk, format: 'jwk' });
+    const signingInput = `${body.protected}.${body.payload}`;
+    const signatureBuffer = Buffer.from(body.signature, 'base64url');
+
+    const supportedAlgs = ['RS256', 'ES256', 'ES384'];
+    if (!supportedAlgs.includes(alg)) {
+      throw new AcmeServerError(400, 'urn:ietf:params:acme:error:badSignatureAlgorithm', `Unsupported algorithm: ${alg}`);
+    }
+
+    let valid: boolean;
+    if (alg.startsWith('RS')) {
+      valid = crypto.verify('sha256', Buffer.from(signingInput), publicKey, signatureBuffer);
+    } else {
+      valid = crypto.verify('sha256', Buffer.from(signingInput), { key: publicKey, dsaEncoding: 'ieee-p1363' }, signatureBuffer);
+    }
+
+    if (!valid) {
+      throw new AcmeServerError(403, 'urn:ietf:params:acme:error:unauthorized', 'Invalid JWS signature');
+    }
+
+    // 8. Decode payload
+    let payload: any;
+    if (body.payload === '') {
+      payload = null; // POST-as-GET
+    } else {
+      try {
+        payload = JSON.parse(Buffer.from(body.payload, 'base64url').toString('utf-8'));
+      } catch {
+        throw new AcmeServerError(400, 'urn:ietf:params:acme:error:malformed', 'Invalid JWS payload');
+      }
+    }
+
+    const thumbprint = AcmeCrypto.getJwkThumbprint(resolvedJwk);
+
+    return {
+      jwk: resolvedJwk,
+      kid: kid || null,
+      thumbprint,
+      payload,
+    };
+  }
+}
+
+/**
+ * Simple error class for ACME server errors that maps to RFC 8555 problem responses.
+ */
+export class AcmeServerError extends Error {
+  public readonly status: number;
+  public readonly type: string;
+  public readonly detail: string;
+
+  constructor(status: number, type: string, detail: string) {
+    super(`${type}: ${detail}`);
+    this.name = 'AcmeServerError';
+    this.status = status;
+    this.type = type;
+    this.detail = detail;
+  }
+}

package/ts_server/server.classes.nonce.ts

@@ -0,0 +1,36 @@
+import * as crypto from 'node:crypto';
+
+/**
+ * Manages ACME replay nonces.
+ * Each nonce is single-use: consumed on verification, fresh one issued with every response.
+ */
+export class NonceManager {
+  private nonces = new Set<string>();
+  private nonceQueue: string[] = [];
+  private maxSize: number;
+
+  constructor(maxSize = 10000) {
+    this.maxSize = maxSize;
+  }
+
+  generate(): string {
+    const nonce = crypto.randomBytes(16).toString('base64url');
+    if (this.nonces.size >= this.maxSize) {
+      const oldest = this.nonceQueue.shift();
+      if (oldest) {
+        this.nonces.delete(oldest);
+      }
+    }
+    this.nonces.add(nonce);
+    this.nonceQueue.push(nonce);
+    return nonce;
+  }
+
+  consume(nonce: string): boolean {
+    if (this.nonces.has(nonce)) {
+      this.nonces.delete(nonce);
+      return true;
+    }
+    return false;
+  }
+}

package/ts_server/server.classes.order.store.ts

@@ -0,0 +1,72 @@
+import type {
+  IServerOrderStore,
+  IServerOrder,
+  IServerAuthorization,
+  IServerChallenge,
+} from './server.interfaces.js';
+
+/**
+ * In-memory order/authorization/challenge/certificate storage for the ACME server.
+ */
+export class MemoryOrderStore implements IServerOrderStore {
+  private orders = new Map<string, IServerOrder>();
+  private authorizations = new Map<string, IServerAuthorization>();
+  private challenges = new Map<string, IServerChallenge>();
+  private certPems = new Map<string, string>();
+
+  async createOrder(order: IServerOrder): Promise<IServerOrder> {
+    this.orders.set(order.id, order);
+    return order;
+  }
+
+  async getOrder(id: string): Promise<IServerOrder | null> {
+    return this.orders.get(id) || null;
+  }
+
+  async updateOrder(id: string, updates: Partial<IServerOrder>): Promise<void> {
+    const order = this.orders.get(id);
+    if (order) {
+      Object.assign(order, updates);
+    }
+  }
+
+  async createAuthorization(authz: IServerAuthorization): Promise<IServerAuthorization> {
+    this.authorizations.set(authz.id, authz);
+    return authz;
+  }
+
+  async getAuthorization(id: string): Promise<IServerAuthorization | null> {
+    return this.authorizations.get(id) || null;
+  }
+
+  async updateAuthorization(id: string, updates: Partial<IServerAuthorization>): Promise<void> {
+    const authz = this.authorizations.get(id);
+    if (authz) {
+      Object.assign(authz, updates);
+    }
+  }
+
+  async createChallenge(challenge: IServerChallenge): Promise<IServerChallenge> {
+    this.challenges.set(challenge.id, challenge);
+    return challenge;
+  }
+
+  async getChallenge(id: string): Promise<IServerChallenge | null> {
+    return this.challenges.get(id) || null;
+  }
+
+  async updateChallenge(id: string, updates: Partial<IServerChallenge>): Promise<void> {
+    const challenge = this.challenges.get(id);
+    if (challenge) {
+      Object.assign(challenge, updates);
+    }
+  }
+
+  async storeCertPem(orderId: string, pem: string): Promise<void> {
+    this.certPems.set(orderId, pem);
+  }
+
+  async getCertPem(orderId: string): Promise<string | null> {
+    return this.certPems.get(orderId) || null;
+  }
+}