certapi 0.1.0__tar.gz → 0.1.1__tar.gz

{certapi-0.1.0 → certapi-0.1.1}/PKG-INFO

@@ -1,8 +1,8 @@
 Metadata-Version: 2.1
 Name: certapi
-Version: 0.1.0
+Version: 0.1.1
 Summary: Python Package for managing keys, request SSL certificates from ACME.
-Home-page: https://github.com/mesudip/certmanager
+Home-page: https://github.com/mesudip/certapi
 Author: Sudip Bhattarai
 Author-email: sudipbhattarai100@gmail.com
 Classifier: Programming Language :: Python :: 3
@@ -13,14 +13,14 @@ Description-Content-Type: text/markdown
 Requires-Dist: cryptography
 Requires-Dist: requests
 
-# CertManager
+# CertApi
 
-CertManager is a Python package for requesting SSL certificates from ACME.
+CertApi is a Python package for requesting SSL certificates from ACME.
 This is supposed to be used as a base library for building other tools, or to integrate Certificate creation feature in you app.
 
 ## Installation
 
-You can install CertManager using pip:
+You can install CertApi using pip:
 
 ```bash
 pip install certapi
@@ -30,7 +30,7 @@ pip install certapi
 
 ```python
 import json
-from certmanager import FileSystemChallengeStore, FilesystemKeyStore, CertAuthority
+from certapi import FileSystemChallengeStore, FilesystemKeyStore, CertAuthority
 
 key_store = FilesystemKeyStore("data")
 challenge_store = FileSystemChallengeStore("./acme-challenges")  # this should be where your web server hosts the .well-known/acme-challenges.

{certapi-0.1.0 → certapi-0.1.1}/README.md

@@ -1,11 +1,11 @@
-# CertManager
+# CertApi
 
-CertManager is a Python package for requesting SSL certificates from ACME.
+CertApi is a Python package for requesting SSL certificates from ACME.
 This is supposed to be used as a base library for building other tools, or to integrate Certificate creation feature in you app.
 
 ## Installation
 
-You can install CertManager using pip:
+You can install CertApi using pip:
 
 ```bash
 pip install certapi
@@ -15,7 +15,7 @@ pip install certapi
 
 ```python
 import json
-from certmanager import FileSystemChallengeStore, FilesystemKeyStore, CertAuthority
+from certapi import FileSystemChallengeStore, FilesystemKeyStore, CertAuthority
 
 key_store = FilesystemKeyStore("data")
 challenge_store = FileSystemChallengeStore("./acme-challenges")  # this should be where your web server hosts the .well-known/acme-challenges.

{certapi-0.1.0 → certapi-0.1.1}/setup.py

@@ -2,7 +2,7 @@ from setuptools import setup, find_packages
 
 setup(
     name="certapi",
-    version="0.1.0",
+    version="0.1.1",
     packages=find_packages(where="src"),
     package_dir={"": "src"},
     install_requires=[
@@ -15,7 +15,7 @@ setup(
     long_description_content_type="text/markdown",
     author="Sudip Bhattarai",
     author_email="sudipbhattarai100@gmail.com",
-    url="https://github.com/mesudip/certmanager",
+    url="https://github.com/mesudip/certapi",
     classifiers=[
         "Programming Language :: Python :: 3",
         "License :: OSI Approved :: MIT License",

{certapi-0.1.0 → certapi-0.1.1}/src/certapi/Acme.py

@@ -12,15 +12,16 @@ from .crypto import sign, digest_sha256, csr_to_der, jwk, get_algorithm_name
 from .util import b64_encode, b64_string
 
 # acme_url = os.environ.get("LETSENCRYPT_API", "https://acme-staging-v02.api.letsencrypt.org/directory")
-acme_url = os.environ.get("LETSENCRYPT_API", "https://acme-v02.api.letsencrypt.org/directory")
+acme_url = os.environ.get("LETSENCRYPT_API", None)
 
 
 class AcmeError(Exception):
     def __init__(self, message, detail, step):
-        super().__init__(step,message)
+        super().__init__(step, message)
         self.message: str = message
         self.step: str = step
         self.detail: dict = detail
+        self.can_retry = False
 
     def json_obj(self) -> dict:
         return {"message": self.message, "step": self.step, "detail": self.detail}
@@ -36,6 +37,7 @@ class AcmeNetworkError(AcmeError, requests.RequestException):
         requests.RequestException.__init__(self, request=request)
         AcmeError.__init__(self, message, detail, step)
         requests.RequestException.__init__(self, request=request)  # Pass message to RequestException
+        self.can_retry = True
 
 
 class AcmeHttpError(AcmeError, requests.HTTPError):
@@ -45,7 +47,7 @@ class AcmeHttpError(AcmeError, requests.HTTPError):
 
     def __init__(self, response: requests.Response, step: str):
         requests.HTTPError.__init__(self, response=response)
-        self.response=response
+        self.response = response
         (message, detail) = self.extract_acme_response_error()
         AcmeError.__init__(self, message, detail, step)
 
@@ -121,8 +123,8 @@ class AcmeHttpError(AcmeError, requests.HTTPError):
                                 message = err_detail
 
             if message is None:
-                if res_json.get('detail'):
-                    message = res_json['detail']
+                if res_json.get("detail"):
+                    message = res_json["detail"]
                 else:
                     message = "Received status=" + str(self.response.status_code) + " from AMCE server"
             if error is None:
@@ -141,22 +143,28 @@ class AcmeInvaliOrderError(AcmeHttpError):
         super().__init__(response, step)
 
 
+class AcmeInvaliNonceError(AcmeHttpError):
+    def __init__(self, response: requests.Response, step: str):
+        super().__init__(response, step)
+        self.can_retry = True
+
+
 def request(method, step: str, url: str, json=None, headers=None, throw=True) -> requests.Response:
-    res=None
+    res = None
     try:
         res = requests.request(method, url, json=json, headers=headers, timeout=15)
-        print("Request ["+str(res.status_code)+"] : " + method + " " + url + " step=" + step)
+        print("Request [" + str(res.status_code) + "] : " + method + " " + url + " step=" + step)
     except requests.HTTPError as e:
         status = res.status_code if res else None
         status = status if status else (e.response.status_code if e.response else None)
         if status:
-            print("Request ["+str(status)+"] : " + method + " " + url + " step=" + step)
+            print("Request [" + str(status) + "] : " + method + " " + url + " step=" + step)
         else:
             print("Request : " + method + " " + url + " step=" + step)
 
         raise e
     except requests.RequestException as e:
-        print("Request : " + method + " " + url + " step=" + step)
+        print("Request : " + str(method) + " " + str(url) + " step=" + str(step))
         raise AcmeNetworkError(
             e.request,
             f"Error communicating with ACME server",
@@ -169,6 +177,18 @@ def request(method, step: str, url: str, json=None, headers=None, throw=True) ->
             step,
         )
     if 199 <= res.status_code > 299:
+        [print(x, y) for (x, y) in res.headers.items()]
+        print("Response:", res.text)
+        json_data = None
+        try:
+            json_data = res.json()
+        except requests.RequestException as e:
+            pass
+        if json_data and json_data.get("type"):
+            errorType = json_data["type"]
+            if errorType == "urn:ietf:params:acme:error:badNonce":
+                raise AcmeInvaliNonceError(res, step=step)
+
         if throw:
             raise AcmeHttpError(res, step=step)
     return res
@@ -192,7 +212,7 @@ class Acme:
         # json web key format for public key
         self.jwk = jwk(self.account_key)
         self.nonce = []
-        self.acme_url = url
+        self.acme_url = url if url else self.URL_PROD
         self.key_id = None
         self.directory = None
         self._nonce_lock = threading.Lock()  # Mutex for safe access to nonce
@@ -210,19 +230,12 @@ class Acme:
         url = self._directory(path_name)
         return self._signed_req(url, payload, depth, step="Acme request:" + path_name)
 
-    def _signed_req(
-        self, url, payload: Union[str, dict, list, bytes, None] = None, depth=0, step="Acme Request", throw=True
-    ) -> requests.Response:
-        payload64 = b64_encode(payload) if payload is not None else b""
+    def get_nonce(self, step: str, counter=1):
         nonce = None
-        with self._nonce_lock:  # Acquire lock to ensure thread-safe access to nonce
-            # Check if there are any nonces available
+        with self._nonce_lock:  # Acquire nonce
             if self.nonce:
-                # Pop the first nonce from the list
                 nonce = self.nonce.pop(0)
-
-                # Fetch a new nonce if the list is empty
-        nonce = (
+        return (
             nonce
             if nonce
             else get(
@@ -230,10 +243,20 @@ class Acme:
             ).headers.get("Replay-Nonce")
         )
 
+    def record_nonce(self, response: requests.Response) -> requests.Response:
+        with self._nonce_lock:
+            self.nonce.append(response.headers.get("Replay-Nonce", None))
+        return response
+
+    def _signed_req(
+        self, url, payload: Union[str, dict, list, bytes, None] = None, depth=0, step="Acme Request", throw=True
+    ) -> requests.Response:
+        payload64 = b64_encode(payload) if payload is not None else b""
+
         protected = {
             "url": url,
             "alg": get_algorithm_name(self.account_key),
-            "nonce": nonce,
+            "nonce": self.get_nonce(step),
         }
 
         if self.key_id:
@@ -246,19 +269,16 @@ class Acme:
             "payload": payload64.decode("utf-8"),
             "signature": b64_string(sign(self.account_key, b".".join([protectedb64, payload64]))),
         }
+        try:
 
-        response = post(step, url, json=payload, headers={"Content-Type": "application/jose+json"}, throw=throw)
-        if response.status_code > 299 or response.status_code < 200 :
-            print("-" * 30 + " Request  " + "-" * 30)
-            print(response.status_code, " : ", url)
-            print("status:", response.status_code)
-            print(json.dumps({x[0]: x[1] for x in response.headers.items()}, indent=2))
-            print(response.text)
-            print("-" * 60)
+            response = post(step, url, json=payload, headers={"Content-Type": "application/jose+json"}, throw=throw)
+        except AcmeError as e:
+            if e.can_retry and depth <= 0:
+                return self._signed_req(url, payload, depth + 1, step, throw)
+            else:
+                raise e
 
-        with self._nonce_lock:
-            self.nonce.append(response.headers.get("Replay-Nonce", None))
-        return response
+        return self.record_nonce(response)
 
     def register(self):
         response = self._directory_req("newAccount", {"termsOfServiceAgreed": True})

{certapi-0.1.0 → certapi-0.1.1}/src/certapi/certauthority.py

@@ -15,8 +15,8 @@ from .db import KeyStore
 
 
 class CertAuthority:
-    def __init__(self, challenge_store: challenge.ChallengeStore, key_store: KeyStore,acme_url=None):
-        self.acme = Acme(key_store.account_key,url=acme_url)
+    def __init__(self, challenge_store: challenge.ChallengeStore, key_store: KeyStore, acme_url=None):
+        self.acme = Acme(key_store.account_key, url=acme_url)
         self.key_store = key_store
         self.challengesStore: challenge.ChallengeStore = challenge_store
 
@@ -28,9 +28,7 @@ class CertAuthority:
         elif res.status_code != 200:
             raise Exception("Acme registration didn't return 200 or 201 ", res.json())
 
-    def obtainCert(
-        self, host: Union[str, List[str]]
-    ) -> Union[Tuple["CertificateResponse", None], Tuple[None, requests.Response]]:
+    def obtainCert(self, host: Union[str, List[str]]) -> "CertificateResponse":
         if type(host) == str:
             host = [host]
 
@@ -73,12 +71,11 @@ class CertAuthority:
                 order.refresh()  # is this refresh necessary?
 
                 if order.status == "valid":
-                    (certificate, _) = order.get_certificate()
+                    certificate = order.get_certificate()
                     key_id = self.key_store.save_key(private_key, missing[0])
                     cert_id = self.key_store.save_cert(key_id, certificate, missing)
                     issued_cert = IssuedCert(key_to_pem(private_key), certificate, missing)
-                    response = createExistingResponse(existing, [issued_cert])
-                    return (response, None)
+                    return createExistingResponse(existing, [issued_cert])
                 elif order.status == "processing":
                     if count == 0:
                         return None
@@ -87,7 +84,7 @@ class CertAuthority:
 
             return obtain_cert()
         else:
-            return createExistingResponse(existing, []), None
+            return createExistingResponse(existing, [])
 
 
 def createExistingResponse(existing: Dict[str, Tuple[int | str, Key, Certificate]], issued_certs: List["IssuedCert"]):

{certapi-0.1.0 → certapi-0.1.1}/src/certapi/db.py

@@ -1,9 +1,9 @@
 import os
 import sqlite3
-from typing import Union, Tuple, Optional
+from typing import Tuple, Optional
+from contextlib import contextmanager
 
 from .crypto import *
-from flask import g
 from abc import ABC, abstractmethod
 
 from .crypto_classes import Key
@@ -32,6 +32,7 @@ class KeyStore(ABC):
 class SqliteKeyStore(KeyStore):
     def __init__(self, db_path="db/database.db"):
         self.db_path = db_path
+        self.db = None
         self._initialize_db()
         self.account_key = self._init_account_key()
 
@@ -64,9 +65,18 @@ class SqliteKeyStore(KeyStore):
             )
 
     def _get_db_connection(self):
-        if "db" not in g:
-            g.db = sqlite3.connect(self.db_path)
-        return g.db
+        if self.db:
+            return self.db
+        target = self
+        try:
+            from flask import g
+
+            target = g
+        except:
+            pass
+        if "db" not in target or target.db is None:
+            target.db = sqlite3.connect(self.db_path)
+        return target.db
 
     def save_key(self, key: RSAPrivateKey, name: str = None) -> int:
         conn = self._get_db_connection()
@@ -218,7 +228,6 @@ class FilesystemKeyStore(KeyStore):
 class PostgresKeyStore(KeyStore):
     def __init__(self, db_url="postgresql://user:password@localhost/dbname"):
         self.db_url = db_url
-
         import psycopg2
 
         self.psycopg2 = psycopg2
@@ -232,7 +241,7 @@ class PostgresKeyStore(KeyStore):
         """Initialize the connection pool."""
         from psycopg2.pool import SimpleConnectionPool
 
-        self.pool = SimpleConnectionPool(1, 1, self.db_url)
+        self.pool = SimpleConnectionPool(1, 10, self.db_url)
 
     def _check_connection(self, conn):
         """Check if the connection is alive by using the `ping` method."""
@@ -242,59 +251,62 @@ class PostgresKeyStore(KeyStore):
         except self.psycopg2.OperationalError:
             return False
 
-    def _get_db_connection(self):
-        """Get a connection from the pool and ensure it is healthy."""
+    @contextmanager
+    def get_connection(self):
+        """Context manager for acquiring and releasing a database connection."""
         conn = self.pool.getconn()
 
-        # Check connection health
-        if not self._check_connection(conn):
-            print("Connection is not healthy, reconnecting...")
-            self.pool.putconn(conn, close=True)  # Close the bad connection
-            conn = self.pool.getconn()  # Get a fresh connection
-
-        return conn
+        try:
+            # Check connection health
+            if not self._check_connection(conn):
+                print("Connection is not healthy, reconnecting...")
+                self.pool.putconn(conn, close=True)  # Close the bad connection
+                conn = self.pool.getconn()  # Get a fresh connection
+
+            # Yield the connection to the caller
+            yield conn
+        finally:
+            # Return the connection to the pool
+            self.pool.putconn(conn)
 
     def _initialize_db(self):
         """Initializes the database with necessary tables."""
-        conn = self._get_db_connection()
-        cur = conn.cursor()
-
-        cur.execute(
+        with self.get_connection() as conn:
+            # Use the connection directly to execute the query
+            conn.execute(
+                """
+                CREATE TABLE IF NOT EXISTS private_keys (
+                    id SERIAL PRIMARY KEY,
+                    name VARCHAR(50) NULL,
+                    content BYTEA
+                );
+                CREATE TABLE IF NOT EXISTS certificates (
+                    id SERIAL PRIMARY KEY,
+                    name VARCHAR(50) NULL,
+                    priv_id INTEGER REFERENCES private_keys NOT NULL,
+                    content BYTEA,
+                    sign_id INTEGER REFERENCES private_keys NULL
+                );
+                CREATE TABLE IF NOT EXISTS ssl_domains (
+                    domain VARCHAR(255),
+                    certificate_id INTEGER REFERENCES certificates
+                );
+                CREATE TABLE IF NOT EXISTS ssl_wildcards (
+                    domain VARCHAR(255),
+                    certificate_id INTEGER REFERENCES certificates
+                );
             """
-            CREATE TABLE IF NOT EXISTS private_keys (
-                id SERIAL PRIMARY KEY,
-                name VARCHAR(50) NULL,
-                content BYTEA
-            );
-            CREATE TABLE IF NOT EXISTS certificates (
-                id SERIAL PRIMARY KEY,
-                name VARCHAR(50) NULL,
-                priv_id INTEGER REFERENCES private_keys NOT NULL,
-                content BYTEA,
-                sign_id INTEGER REFERENCES private_keys NULL
-            );
-            CREATE TABLE IF NOT EXISTS ssl_domains (
-                domain VARCHAR(255),
-                certificate_id INTEGER REFERENCES certificates
-            );
-            CREATE TABLE IF NOT EXISTS ssl_wildcards (
-                domain VARCHAR(255),
-                certificate_id INTEGER REFERENCES certificates
-            );
-        """
-        )
-
-        cur.close()
-        conn.commit()
+            )
+            # No need to explicitly commit here
 
     def save_key(self, key: RSAPrivateKey, name: str = None) -> int:
         """Saves a private key in the database."""
-        conn = self._get_db_connection()
-        cur = conn.cursor()
-        cur.execute("INSERT INTO private_keys (name, content) VALUES (%s, %s) RETURNING id", (name, key_to_der(key)))
-        key_id = cur.fetchone()[0]
-        cur.close()
-        conn.commit()
+        with self.get_connection() as conn:
+            # Execute the insert directly
+            conn.execute(
+                "INSERT INTO private_keys (name, content) VALUES (%s, %s) RETURNING id", (name, key_to_der(key))
+            )
+            key_id = conn.fetchone()[0]  # Fetch the inserted ID
         return key_id
 
     def gen_key(self, name: str = None, size: int = 4096) -> RSAPrivateKey:
@@ -305,61 +317,51 @@ class PostgresKeyStore(KeyStore):
 
     def save_cert(self, private_key_id: int, cert: Certificate, domains: List[str], name: str = None) -> int:
         """Saves a certificate along with associated domains."""
-        conn = self._get_db_connection()
-        cur = conn.cursor()
-
-        # Insert certificate
-        cur.execute(
-            "INSERT INTO certificates (name, priv_id, content) VALUES (%s, %s, %s) RETURNING id",
-            (name, private_key_id, cert.public_bytes(serialization.Encoding.DER)),
-        )
-        cert_id = cur.fetchone()[0]
+        with self.get_connection() as conn:
+            # Insert certificate and associated domains directly
+            conn.execute(
+                "INSERT INTO certificates (name, priv_id, content) VALUES (%s, %s, %s) RETURNING id",
+                (name, private_key_id, cert.public_bytes(serialization.Encoding.DER)),
+            )
+            cert_id = conn.fetchone()[0]
 
-        # Insert associated domains
-        for domain in domains:
-            cur.execute("INSERT INTO ssl_domains (domain, certificate_id) VALUES (%s, %s)", (domain, cert_id))
+            # Insert associated domains
+            for domain in domains:
+                conn.execute("INSERT INTO ssl_domains (domain, certificate_id) VALUES (%s, %s)", (domain, cert_id))
 
-        cur.close()
-        conn.commit()
         return cert_id
 
     def get_cert(self, domain: str) -> Optional[Tuple[int, RSAPrivateKey, Certificate]]:
         """Fetches a certificate and its associated private key for a domain."""
-        conn = self._get_db_connection()
-        cur = conn.cursor()
-
-        cur.execute(
-            """
-            SELECT c.id, p.content, c.content
-            FROM ssl_domains s
-            JOIN certificates c ON s.certificate_id = c.id
-            JOIN private_keys p ON c.priv_id = p.id
-            WHERE s.domain = %s
-        """,
-            (domain,),
-        )
-        res = cur.fetchone()
-
-        cur.close()
-        conn.commit()
+        with self.get_connection() as conn:
+            # Directly execute and fetch result
+            conn.execute(
+                """
+                SELECT c.id, p.content, c.content
+                FROM ssl_domains s
+                JOIN certificates c ON s.certificate_id = c.id
+                JOIN private_keys p ON c.priv_id = p.id
+                WHERE s.domain = %s
+            """,
+                (domain,),
+            )
+            res = conn.fetchone()
 
-        if res:
-            return (res[0], Key.from_der(res[1]), cert_from_der(res[2]))
+            if res:
+                return (res[0], Key.from_der(res[1]), cert_from_der(res[2]))
         return None
 
     def _init_account_key(self) -> RSAPrivateKey:
         """Initializes or retrieves the ACME account key."""
         acme_key_name = "ACME Account Key"
-        conn = self._get_db_connection()
-        cur = conn.cursor()
-        cur.execute("SELECT content FROM private_keys WHERE name = %s", (acme_key_name,))
-        account_key_data = cur.fetchone()
-
-        if not account_key_data:
-            account_key = self.gen_key(acme_key_name)
-        else:
-            account_key = key_from_der(account_key_data[0])
-
-        cur.close()
+        with self.get_connection() as conn:
+            # Directly execute to fetch the account key
+            conn.execute("SELECT content FROM private_keys WHERE name = %s", (acme_key_name,))
+            account_key_data = conn.fetchone()
+
+            if not account_key_data:
+                account_key = self.gen_key(acme_key_name)
+            else:
+                account_key = key_from_der(account_key_data[0])
 
         return account_key

{certapi-0.1.0 → certapi-0.1.1}/src/certapi.egg-info/PKG-INFO

@@ -1,8 +1,8 @@
 Metadata-Version: 2.1
 Name: certapi
-Version: 0.1.0
+Version: 0.1.1
 Summary: Python Package for managing keys, request SSL certificates from ACME.
-Home-page: https://github.com/mesudip/certmanager
+Home-page: https://github.com/mesudip/certapi
 Author: Sudip Bhattarai
 Author-email: sudipbhattarai100@gmail.com
 Classifier: Programming Language :: Python :: 3
@@ -13,14 +13,14 @@ Description-Content-Type: text/markdown
 Requires-Dist: cryptography
 Requires-Dist: requests
 
-# CertManager
+# CertApi
 
-CertManager is a Python package for requesting SSL certificates from ACME.
+CertApi is a Python package for requesting SSL certificates from ACME.
 This is supposed to be used as a base library for building other tools, or to integrate Certificate creation feature in you app.
 
 ## Installation
 
-You can install CertManager using pip:
+You can install CertApi using pip:
 
 ```bash
 pip install certapi
@@ -30,7 +30,7 @@ pip install certapi
 
 ```python
 import json
-from certmanager import FileSystemChallengeStore, FilesystemKeyStore, CertAuthority
+from certapi import FileSystemChallengeStore, FilesystemKeyStore, CertAuthority
 
 key_store = FilesystemKeyStore("data")
 challenge_store = FileSystemChallengeStore("./acme-challenges")  # this should be where your web server hosts the .well-known/acme-challenges.

{certapi-0.1.0 → certapi-0.1.1}/tests/test_custom_certauthority.py

@@ -1,7 +1,7 @@
 import pytest
 from cryptography.hazmat.primitives import serialization
-from certmanager.crypto import gen_key_rsa, key_to_pem
-from certmanager.custom_certauthority import CustomCertAuthority
+from certapi.crypto import gen_key_rsa, key_to_pem
+from certapi.custom_certauthority import CustomCertAuthority
 import os
 from contextlib import contextmanager