yusufkhon-guard 1.0.0

package/src/modules/acme/detectDomains.js

@@ -0,0 +1,132 @@
+'use strict';
+
+/**
+ * @file detectDomains.js
+ * @description VPS'da sozlangan domen(lar)ni AVTOMAT aniqlaydi — foydalanuvchi
+ *              `--domain` bermasa, `npx yusufkhon-guard ssl` o'zi topib, admin'ga
+ *              tasdiqlash uchun ko'rsatadi.
+ *
+ *              Manbalar: nginx `server_name`, apache `ServerName`/`ServerAlias`,
+ *              tizim hostnomi (FQDN bo'lsa). Yo'llar test uchun sozlanadi.
+ * @module modules/acme/detectDomains
+ */
+
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+
+/** Standart nginx konfiguratsiya yo'llari. @type {string[]} */
+const DEFAULT_NGINX = ['/etc/nginx/sites-enabled', '/etc/nginx/conf.d', '/etc/nginx/nginx.conf'];
+/** Standart apache konfiguratsiya yo'llari. @type {string[]} */
+const DEFAULT_APACHE = ['/etc/apache2/sites-enabled', '/etc/httpd/conf.d'];
+
+/**
+ * Nomzod haqiqiy, ommaviy domenmi? (localhost, IP, wildcard, .local rad etiladi)
+ * @param {string} d
+ * @returns {boolean}
+ */
+function isValidDomain(d) {
+  if (!d) return false;
+  const s = String(d).toLowerCase().trim().replace(/;$/, '');
+  if (s === 'localhost' || s === '_' || s === '""') return false;
+  if (s.startsWith('*.') || s.includes('*')) return false;         // wildcard -> DNS-01 kerak
+  if (/^\d{1,3}(\.\d{1,3}){3}$/.test(s)) return false;              // IPv4
+  if (s.includes(':')) return false;                                // IPv6/port
+  if (/\.(local|lan|localdomain|internal|test|example|invalid)$/.test(s)) return false;
+  if (!s.includes('.')) return false;                               // FQDN bo'lishi shart
+  return /^[a-z0-9.-]+$/.test(s) && !s.startsWith('.') && !s.endsWith('.');
+}
+
+/**
+ * Fayl yoki papkadan barcha matn kontentini o'qiydi (xatolarni e'tiborsiz qoldiradi).
+ * @param {string} target
+ * @returns {string[]}
+ */
+function readAll(target) {
+  const out = [];
+  try {
+    const st = fs.statSync(target);
+    if (st.isDirectory()) {
+      for (const name of fs.readdirSync(target)) {
+        try { out.push(fs.readFileSync(path.join(target, name), 'utf8')); } catch { /* skip */ }
+      }
+    } else {
+      out.push(fs.readFileSync(target, 'utf8'));
+    }
+  } catch { /* mavjud emas — skip */ }
+  return out;
+}
+
+/**
+ * nginx kontentidan `server_name` domenlarini ajratadi.
+ * @param {string} content
+ * @returns {string[]}
+ */
+function parseNginx(content) {
+  const out = [];
+  const re = /server_name\s+([^;]+);/gi;
+  let m;
+  while ((m = re.exec(content))) {
+    for (const tok of m[1].trim().split(/\s+/)) out.push(tok);
+  }
+  return out;
+}
+
+/**
+ * apache kontentidan `ServerName`/`ServerAlias` domenlarini ajratadi.
+ * @param {string} content
+ * @returns {string[]}
+ */
+function parseApache(content) {
+  const out = [];
+  let m;
+  const reName = /^\s*ServerName\s+(\S+)/gim;
+  while ((m = reName.exec(content))) out.push(m[1]);
+  const reAlias = /^\s*ServerAlias\s+([^\n]+)/gim;
+  while ((m = reAlias.exec(content))) for (const tok of m[1].trim().split(/\s+/)) out.push(tok);
+  return out;
+}
+
+/**
+ * @typedef {Object} DetectedDomain
+ * @property {string} domain
+ * @property {string} source - 'nginx' | 'apache' | 'hostname'
+ */
+
+/**
+ * VPS'dagi sozlangan domenlarni aniqlaydi.
+ * @param {Object} [options]
+ * @param {string[]} [options.nginxPaths] - nginx yo'llari (test uchun).
+ * @param {string[]} [options.apachePaths] - apache yo'llari (test uchun).
+ * @param {string} [options.hostname] - tizim hostnomi (test uchun).
+ * @returns {DetectedDomain[]} Takrorlanmas, haqiqiy domenlar (aniqlanish tartibida).
+ */
+function detectDomains(options = {}) {
+  /** @type {DetectedDomain[]} */
+  const found = [];
+  const add = (domain, source) => {
+    const d = String(domain).toLowerCase().trim().replace(/;$/, '');
+    if (isValidDomain(d) && !found.some((f) => f.domain === d)) found.push({ domain: d, source });
+  };
+
+  for (const p of options.nginxPaths || DEFAULT_NGINX) {
+    for (const content of readAll(p)) for (const d of parseNginx(content)) add(d, 'nginx');
+  }
+  for (const p of options.apachePaths || DEFAULT_APACHE) {
+    for (const content of readAll(p)) for (const d of parseApache(content)) add(d, 'apache');
+  }
+
+  const hostname = options.hostname !== undefined ? options.hostname : os.hostname();
+  add(hostname, 'hostname');
+
+  return found;
+}
+
+module.exports = {
+  detectDomains,
+  isValidDomain,
+  parseNginx,
+  parseApache,
+  DEFAULT_NGINX,
+  DEFAULT_APACHE,
+};

package/src/modules/acme/index.js

@@ -0,0 +1,211 @@
+'use strict';
+
+/**
+ * @file acme/index.js
+ * @description Let's Encrypt (ACME v2) uchun yuqori darajali, foydalanish oson API.
+ *              HTTP-01 challenge'ni bajarish orqali domen uchun bepul SSL/TLS
+ *              sertifikatini avtomat oladi. Tashqi kutubxonasiz (faqat Node ichki
+ *              `crypto`, `fetch`, `fs`).
+ *
+ *              DIQQAT: HTTP-01 uchun domen 80-portda ilovangizga yo'naltirilgan
+ *              va internetdan ochiq bo'lishi kerak. Challenge middleware'ni
+ *              firewall'dan OLDIN ulang.
+ * @module modules/acme
+ */
+
+const fs = require('fs');
+const path = require('path');
+const jose = require('./jose');
+const { createCsr } = require('./csr');
+const { AcmeClient, DIRECTORY_URLS } = require('./client');
+const { detectDomains } = require('./detectDomains');
+const { checkCert, needsRenewal, certDomains, daysUntilExpiry } = require('./renew');
+const { defaultLogger } = require('../../utils/logger');
+
+/**
+ * HTTP-01 challenge javoblarini saqlovchi oddiy xotira ombori.
+ * @class
+ */
+class ChallengeStore {
+  constructor() {
+    /** @type {Map<string, string>} token -> keyAuthorization */
+    this.map = new Map();
+  }
+  /** @param {string} token @param {string} keyAuth @returns {void} */
+  set(token, keyAuth) { this.map.set(token, keyAuth); }
+  /** @param {string} token @returns {string|undefined} */
+  get(token) { return this.map.get(token); }
+  /** @param {string} token @returns {void} */
+  remove(token) { this.map.delete(token); }
+}
+
+/**
+ * `/.well-known/acme-challenge/<token>` so'rovlariga javob beruvchi Express
+ * middleware. Uni firewall/guard'dan OLDIN ulang.
+ *
+ * @example
+ * const acme = require('yusufkhon-guard').acme;
+ * const store = new acme.ChallengeStore();
+ * app.use(acme.challengeMiddleware(store)); // guard'dan oldin!
+ *
+ * @param {ChallengeStore} store
+ * @returns {import('express').RequestHandler}
+ */
+function challengeMiddleware(store) {
+  const PREFIX = '/.well-known/acme-challenge/';
+  return function acmeChallengeMiddleware(req, res, next) {
+    const url = req.originalUrl || req.url || '';
+    if (req.method === 'GET' && url.startsWith(PREFIX)) {
+      const token = url.slice(PREFIX.length).split('?')[0];
+      const keyAuth = store.get(token);
+      if (keyAuth) {
+        res.statusCode = 200;
+        res.setHeader('Content-Type', 'text/plain');
+        res.end(keyAuth);
+        return;
+      }
+      res.statusCode = 404;
+      res.end('Not found');
+      return;
+    }
+    return next();
+  };
+}
+
+/**
+ * Hisob kalitini fayldan yuklaydi yoki yangisini yaratib saqlaydi.
+ * @private
+ * @param {string|undefined} keyPath
+ * @param {import('../../utils/logger').Logger} logger
+ * @returns {import('crypto').KeyObject}
+ */
+function loadOrCreateAccountKey(keyPath, logger) {
+  if (keyPath && fs.existsSync(keyPath)) {
+    logger.info('Mavjud ACME hisob kaliti yuklandi.');
+    return jose.importPrivateKeyPem(fs.readFileSync(keyPath, 'utf8'));
+  }
+  const { privateKey } = jose.generateAccountKey();
+  if (keyPath) {
+    fs.mkdirSync(path.dirname(path.resolve(keyPath)), { recursive: true });
+    fs.writeFileSync(keyPath, jose.exportPrivateKeyPem(privateKey), { mode: 0o600 });
+    logger.info('Yangi ACME hisob kaliti yaratildi va saqlandi.');
+  }
+  return privateKey;
+}
+
+/**
+ * @typedef {Object} ObtainOptions
+ * @property {string|string[]} domains - Sertifikat qamrab oladigan domen(lar).
+ * @property {string} [email] - Bog'lanish uchun email (tavsiya etiladi).
+ * @property {ChallengeStore} challengeStore - challengeMiddleware bilan bir xil ombor.
+ * @property {'staging'|'production'} [environment='staging'] - Sinov (staging) yoki jonli.
+ * @property {string} [certDir='./certs'] - Sertifikat saqlanadigan papka.
+ * @property {string} [accountKeyPath] - Hisob kaliti saqlanadigan fayl (qayta ishlatish uchun).
+ * @property {import('../../utils/logger').Logger} [logger=defaultLogger] - Logger.
+ */
+
+/**
+ * @typedef {Object} ObtainResult
+ * @property {string} certificate - PEM sertifikat zanjiri (fullchain).
+ * @property {string} privateKey - Domen yopiq kaliti (PEM).
+ * @property {{ fullchain: string, privkey: string }} paths - Yozilgan fayllar yo'llari.
+ * @property {string} environment - Ishlatilgan muhit.
+ */
+
+/**
+ * Domen(lar) uchun ACME (Let's Encrypt) orqali SSL sertifikatini to'liq avtomat oladi.
+ *
+ * Standart holatda **staging** muhitida ishlaydi (soxta, lekin xavfsiz sertifikat) —
+ * jonli sertifikat uchun `environment: 'production'` bering.
+ *
+ * @example
+ * const acme = require('yusufkhon-guard').acme;
+ * const store = new acme.ChallengeStore();
+ * app.use(acme.challengeMiddleware(store));
+ * // ... server 80-portda ishga tushgach:
+ * const res = await acme.obtainCertificate({
+ *   domains: 'example.com',
+ *   email: 'admin@example.com',
+ *   challengeStore: store,
+ *   environment: 'production',
+ * });
+ *
+ * @param {ObtainOptions} options
+ * @returns {Promise<ObtainResult>}
+ */
+async function obtainCertificate(options) {
+  const logger = options.logger || defaultLogger;
+  const domains = Array.isArray(options.domains) ? options.domains : [options.domains];
+  const environment = options.environment || 'staging';
+  const certDir = path.resolve(options.certDir || './certs');
+  const store = options.challengeStore;
+
+  if (!store) throw new Error('obtainCertificate(): `challengeStore` majburiy.');
+  if (!domains.length || !domains[0]) throw new Error('obtainCertificate(): `domains` majburiy.');
+
+  logger.info(`ACME sertifikat jarayoni boshlandi [${environment}]: ${domains.join(', ')}`);
+
+  const accountKey = loadOrCreateAccountKey(options.accountKeyPath, logger);
+  const client = new AcmeClient({ environment, accountKey, logger });
+
+  await client.init();
+  await client.createAccount({ email: options.email });
+
+  const { order, orderUrl } = await client.createOrder(domains);
+  logger.info(`Buyurtma ochildi (${order.authorizations.length} ta avtorizatsiya).`);
+
+  // Har bir domen avtorizatsiyasini HTTP-01 orqali bajaramiz.
+  for (const authUrl of order.authorizations) {
+    const auth = await client.getAuthorization(authUrl);
+    const challenge = (auth.challenges || []).find((c) => c.type === 'http-01');
+    if (!challenge) throw new Error(`http-01 challenge topilmadi: ${auth.identifier && auth.identifier.value}`);
+
+    const keyAuth = client.keyAuthorization(challenge.token);
+    store.set(challenge.token, keyAuth);
+    logger.info(`Challenge o'rnatildi: ${auth.identifier.value}`);
+
+    await client.completeChallenge(challenge.url);
+    await client.poll(authUrl, ['valid'], { tries: 20, intervalMs: 3000 });
+    store.remove(challenge.token);
+    logger.success(`Domen tasdiqlandi: ${auth.identifier.value}`);
+  }
+
+  // CSR yaratib, buyurtmani yakunlaymiz.
+  const csr = createCsr(domains);
+  await client.finalizeOrder(order.finalize, csr.csrDerBase64Url);
+  const finalOrder = await client.poll(orderUrl, ['valid'], { tries: 20, intervalMs: 3000 });
+
+  const certificate = await client.downloadCertificate(finalOrder.certificate);
+
+  // Fayllarga yozamiz.
+  fs.mkdirSync(certDir, { recursive: true });
+  const fullchainPath = path.join(certDir, 'fullchain.pem');
+  const privkeyPath = path.join(certDir, 'privkey.pem');
+  fs.writeFileSync(fullchainPath, certificate);
+  fs.writeFileSync(privkeyPath, csr.privateKeyPem, { mode: 0o600 });
+
+  logger.success(`✅ Sertifikat olindi va saqlandi: ${certDir}`);
+
+  return {
+    certificate,
+    privateKey: csr.privateKeyPem,
+    paths: { fullchain: fullchainPath, privkey: privkeyPath },
+    environment,
+  };
+}
+
+module.exports = {
+  obtainCertificate,
+  challengeMiddleware,
+  ChallengeStore,
+  AcmeClient,
+  createCsr,
+  jose,
+  DIRECTORY_URLS,
+  // Auto-detect va yangilash (renewal)
+  detectDomains,
+  checkCert,
+  needsRenewal,
+  certDomains,
+  daysUntilExpiry,
+};

package/src/modules/acme/jose.js

@@ -0,0 +1,125 @@
+'use strict';
+
+/**
+ * @file jose.js
+ * @description ACME v2 (RFC 8555) uchun JOSE/JWS kriptografik yordamchilari.
+ *              Faqat Node.js ichki `crypto` modulidan foydalanadi (zero-dependency).
+ *              Hisob (account) kaliti sifatida ECDSA P-256 (ES256) ishlatiladi.
+ * @module modules/acme/jose
+ */
+
+const crypto = require('crypto');
+
+/**
+ * Buffer yoki matnni base64url ko'rinishiga o'giradi (to'ldiruvchi `=` siz).
+ * @param {Buffer|string} input
+ * @returns {string}
+ */
+function base64url(input) {
+  const buf = Buffer.isBuffer(input) ? input : Buffer.from(String(input));
+  return buf.toString('base64').replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+
+/**
+ * Obyektni JSON -> base64url ko'rinishiga o'giradi.
+ * @param {Object} obj
+ * @returns {string}
+ */
+function base64urlJson(obj) {
+  return base64url(JSON.stringify(obj));
+}
+
+/**
+ * Yangi ECDSA P-256 (ES256) kalit juftligini yaratadi.
+ * @returns {{ publicKey: crypto.KeyObject, privateKey: crypto.KeyObject }}
+ */
+function generateAccountKey() {
+  return crypto.generateKeyPairSync('ec', { namedCurve: 'P-256' });
+}
+
+/**
+ * PEM matnidan yopiq (private) kalitni tiklaydi.
+ * @param {string} pem - PKCS#8 PEM.
+ * @returns {crypto.KeyObject}
+ */
+function importPrivateKeyPem(pem) {
+  return crypto.createPrivateKey(pem);
+}
+
+/**
+ * Yopiq kalitni PKCS#8 PEM ko'rinishida eksport qiladi (faylga saqlash uchun).
+ * @param {crypto.KeyObject} privateKey
+ * @returns {string}
+ */
+function exportPrivateKeyPem(privateKey) {
+  return privateKey.export({ type: 'pkcs8', format: 'pem' }).toString();
+}
+
+/**
+ * Ochiq kalitning ACME talab qiladigan JWK (faqat kerakli maydonlar) ko'rinishi.
+ * Maydonlar tartibi thumbprint uchun muhim (leksikografik).
+ * @param {crypto.KeyObject} publicKey
+ * @returns {{ crv: string, kty: string, x: string, y: string }}
+ */
+function publicJwk(publicKey) {
+  const jwk = publicKey.export({ format: 'jwk' });
+  // RFC 7638 bo'yicha thumbprint uchun aynan shu tartib va maydonlar.
+  return { crv: jwk.crv, kty: jwk.kty, x: jwk.x, y: jwk.y };
+}
+
+/**
+ * JWK thumbprint (RFC 7638) — SHA-256, base64url. HTTP-01 kalit avtorizatsiyasida
+ * ishlatiladi.
+ * @param {{ crv: string, kty: string, x: string, y: string }} jwk
+ * @returns {string}
+ */
+function jwkThumbprint(jwk) {
+  const canonical = JSON.stringify({ crv: jwk.crv, kty: jwk.kty, x: jwk.x, y: jwk.y });
+  return base64url(crypto.createHash('sha256').update(canonical).digest());
+}
+
+/**
+ * ACME "flattened JWS" imzolangan so'rov tanasini tuzadi.
+ *
+ * @param {Object} params
+ * @param {crypto.KeyObject} params.privateKey - Hisob yopiq kaliti (ES256).
+ * @param {string} params.url - So'rov yuboriladigan ACME URL (protected header'ga kiradi).
+ * @param {string} params.nonce - Replay-Nonce qiymati.
+ * @param {Object|string} params.payload - Yuk (bo'sh POST-as-GET uchun "" bering).
+ * @param {string} [params.kid] - Hisob URL'i (mavjud bo'lsa `jwk` o'rniga ishlatiladi).
+ * @param {{crv:string,kty:string,x:string,y:string}} [params.jwk] - newAccount uchun ochiq JWK.
+ * @returns {string} `application/jose+json` uchun tayyor JSON matn.
+ */
+function signedJws({ privateKey, url, nonce, payload, kid, jwk }) {
+  /** @type {Object} */
+  const protectedHeader = { alg: 'ES256', nonce, url };
+  if (kid) protectedHeader.kid = kid;
+  else protectedHeader.jwk = jwk;
+
+  const protected64 = base64urlJson(protectedHeader);
+  const payload64 = payload === '' ? '' : base64urlJson(payload);
+  const signingInput = `${protected64}.${payload64}`;
+
+  // ES256: ECDSA imzosi JOSE formatida (r||s, 64 bayt) bo'lishi shart.
+  const signature = crypto.sign('SHA256', Buffer.from(signingInput), {
+    key: privateKey,
+    dsaEncoding: 'ieee-p1363',
+  });
+
+  return JSON.stringify({
+    protected: protected64,
+    payload: payload64,
+    signature: base64url(signature),
+  });
+}
+
+module.exports = {
+  base64url,
+  base64urlJson,
+  generateAccountKey,
+  importPrivateKeyPem,
+  exportPrivateKeyPem,
+  publicJwk,
+  jwkThumbprint,
+  signedJws,
+};

package/src/modules/acme/renew.js

@@ -0,0 +1,89 @@
+'use strict';
+
+/**
+ * @file renew.js
+ * @description Sertifikat yangilash yordamchilari. Mavjud sertifikatning amal
+ *              qilish muddatini va SAN domenlarini o'qiydi hamda `<N kun` qolganini
+ *              (yangilash kerakligini) aniqlaydi. Node ichki `crypto.X509Certificate`
+ *              dan foydalanadi.
+ * @module modules/acme/renew
+ */
+
+const fs = require('fs');
+const crypto = require('crypto');
+
+/**
+ * PEM sertifikatdan SAN (subjectAltName) domenlarini oladi.
+ * @param {string} pem
+ * @returns {string[]} DNS domenlari.
+ */
+function certDomains(pem) {
+  const cert = new crypto.X509Certificate(pem);
+  const san = cert.subjectAltName || '';
+  return san
+    .split(',')
+    .map((s) => s.trim())
+    .filter((s) => s.toUpperCase().startsWith('DNS:'))
+    .map((s) => s.slice(4).trim().toLowerCase());
+}
+
+/**
+ * PEM sertifikat tugashiga necha kun qolganini qaytaradi (o'tgan bo'lsa manfiy).
+ * @param {string} pem
+ * @returns {number}
+ */
+function daysUntilExpiry(pem) {
+  const cert = new crypto.X509Certificate(pem);
+  const to = new Date(cert.validTo).getTime();
+  return Math.floor((to - Date.now()) / (24 * 60 * 60 * 1000));
+}
+
+/**
+ * @typedef {Object} CertStatus
+ * @property {boolean} exists - Fayl mavjudmi.
+ * @property {number} [daysLeft] - Tugashiga qolgan kunlar.
+ * @property {string[]} [domains] - SAN domenlari.
+ * @property {boolean} needsRenewal - Yangilash kerakmi.
+ * @property {string} reason
+ */
+
+/**
+ * Sertifikat holatini tekshiradi (mavjudmi, qancha qolgan, yangilash kerakmi).
+ * @param {string} certPath - fullchain.pem yo'li.
+ * @param {number} [thresholdDays=30] - Shu kundan kam qolsa — yangilanadi.
+ * @returns {CertStatus}
+ */
+function checkCert(certPath, thresholdDays = 30) {
+  let pem;
+  try {
+    pem = fs.readFileSync(certPath, 'utf8');
+  } catch {
+    return { exists: false, needsRenewal: true, reason: 'sertifikat topilmadi' };
+  }
+  try {
+    const daysLeft = daysUntilExpiry(pem);
+    const domains = certDomains(pem);
+    const need = daysLeft < thresholdDays;
+    return {
+      exists: true,
+      daysLeft,
+      domains,
+      needsRenewal: need,
+      reason: need ? `${daysLeft} kun qoldi (< ${thresholdDays})` : `${daysLeft} kun qoldi — hali yangi`,
+    };
+  } catch (e) {
+    return { exists: true, needsRenewal: true, reason: 'sertifikatni o\'qib bo\'lmadi: ' + e.message };
+  }
+}
+
+/**
+ * Sertifikatni yangilash kerakmi (qisqa yordamchi).
+ * @param {string} certPath
+ * @param {number} [thresholdDays=30]
+ * @returns {boolean}
+ */
+function needsRenewal(certPath, thresholdDays = 30) {
+  return checkCert(certPath, thresholdDays).needsRenewal;
+}
+
+module.exports = { certDomains, daysUntilExpiry, checkCert, needsRenewal };