certapi 0.2.2__tar.gz → 0.2.4__tar.gz

{certapi-0.2.2 → certapi-0.2.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: certapi
-Version: 0.2.2
+Version: 0.2.4
 Summary: Python Package for managing keys, request SSL certificates from ACME.
 Home-page: https://github.com/mesudip/certapi
 Author: Sudip Bhattarai
@@ -16,6 +16,8 @@ Description-Content-Type: text/markdown
 CertApi is a Python package for requesting SSL certificates from ACME.
 This is supposed to be used as a base library for building other tools, or to integrate Certificate creation feature in you app.
 
+> ⚠️ Warning: This project is not polished for production use. Please stay tuned for the LTS `v1.0.0` release.
+
 ## Installation
 
 You can install CertApi using pip:

{certapi-0.2.2 → certapi-0.2.4}/README.md

@@ -3,6 +3,8 @@
 CertApi is a Python package for requesting SSL certificates from ACME.
 This is supposed to be used as a base library for building other tools, or to integrate Certificate creation feature in you app.
 
+> ⚠️ Warning: This project is not polished for production use. Please stay tuned for the LTS `v1.0.0` release.
+
 ## Installation
 
 You can install CertApi using pip:

{certapi-0.2.2 → certapi-0.2.4}/setup.py

@@ -2,7 +2,7 @@ from setuptools import setup, find_packages
 
 setup(
     name="certapi",
-    version="0.2.2",
+    version="0.2.4",
     packages=find_packages(where="src"),
     package_dir={"": "src"},
     install_requires=[

{certapi-0.2.2 → certapi-0.2.4}/src/certapi/Acme.py

@@ -1,6 +1,7 @@
 import os
 import re
 import threading
+import time
 from typing import Union, List, Tuple
 import json
 from cryptography.hazmat.primitives.asymmetric.ec import EllipticCurvePrivateKey
@@ -81,7 +82,6 @@ class AcmeHttpError(AcmeError, requests.HTTPError):
                             "resolved": validation_record["addressesResolved"],
                             "used": validation_record["addressUsed"],
                         }
-                        err_detail: str = error["detail"]
                         if error["type"] == "urn:ietf:params:acme:error:connection":
                             if "Timeout during connect" in err_detail:
                                 error["connect"] = {"error": "Timeout"}
@@ -276,6 +276,7 @@ class Acme:
             response = post(step, url, json=payload, headers={"Content-Type": "application/jose+json"}, throw=throw)
         except AcmeError as e:
             if e.can_retry and depth <= 0:
+                time.sleep(2)
                 return self._signed_req(url, payload, depth + 1, step, throw)
             else:
                 raise e
@@ -325,7 +326,7 @@ class Order:
         self.status = self._data["status"]
         return response
 
-    def get_certificate(self) -> Certificate:
+    def get_certificate(self) -> Tuple[str, List[Certificate]]:
         if self.status == "processing":
             raise ValueError(
                 "Order is still in 'processing' state! Wait until the order is finalized, and  call `Order.refresh()`  to update the state"
@@ -336,8 +337,8 @@ class Order:
         certificate_res = self._acme._signed_req(
             self._data["certificate"], step="Get Certificate from Successful Order"
         )
-        certificate = crypto.x509.load_pem_x509_certificate(certificate_res.content)
-        return certificate
+        certificate = crypto.x509.load_pem_x509_certificates(certificate_res.content)
+        return ( certificate_res.content, certificate)
 
     def finalize(self, csr: CertificateSigningRequest):
         """

{certapi-0.2.2 → certapi-0.2.4}/src/certapi/certauthority.py

@@ -121,10 +121,10 @@ class CertAuthority:
                 order.refresh()  # is this refresh necessary?
 
                 if order.status == "valid":
-                    certificate = order.get_certificate()
+                    fullchain_cert,certificate =  order.get_certificate()
                     key_id = self.key_store.save_key(private_key, missing[0])
                     cert_id = self.key_store.save_cert(key_id, certificate, missing)
-                    issued_cert = IssuedCert(key_to_pem(private_key), certificate, missing)
+                    issued_cert = IssuedCert(key_to_pem(private_key), fullchain_cert, missing)
                     # Clean up challenges after successful certificate issuance
                     for c in challenges:
                         challenge_name = f"_acme-challenge.{c.domain}" if has_wildcard else c.token
@@ -145,24 +145,28 @@ class CertAuthority:
             return createExistingResponse(existing, [])
 
 
-def createExistingResponse(existing: Dict[str, Tuple[int | str, Key, Certificate]], issued_certs: List["IssuedCert"]):
+def createExistingResponse(existing: Dict[str, Tuple[int | str, Key, Certificate | str]], issued_certs: List["IssuedCert"]):
     certs = []
     certMap = {}
+
     for h, (id, key, cert) in existing.items():
         if id in certMap:
             certMap[id][0].append(h)
         else:
+            cert_pem = cert if isinstance(cert, str) else cert_to_pem(cert).decode("utf-8")
             certMap[id] = (
                 [h],
                 key.to_pem().decode("utf-8"),
-                cert_to_pem(cert).decode("utf-8"),
+                cert_pem,
             )
+
     for hosts, key, cert in certMap.values():
         certs.append(IssuedCert(key, cert, hosts))
 
     return CertificateResponse(certs, issued_certs)
 
 
+
 class CertificateResponse:
     def __init__(self, existing, issued):
         self.existing: List[IssuedCert] = existing

{certapi-0.2.2 → certapi-0.2.4}/src/certapi/cloudflare_challenge_store.py

@@ -7,7 +7,7 @@ from certapi.cloudflare_client import Cloudflare
 class CloudflareChallengeStore(ChallengeStore):
     def __init__(self):
         self.cloudflare = Cloudflare()
-        self.challenges_map = {}  # Stores key: record_id (still needed for deletion)
+        self.challenges_map = {}  # Stores key: record_id (needed for deletion)
 
     def has_domain(self, domain: str) -> bool:
         """

{certapi-0.2.2 → certapi-0.2.4}/src/certapi/crypto.py

@@ -106,6 +106,11 @@ def key_from_pem(data: bytes):
 def cert_from_pem(data: bytes) -> Certificate:
     return x509.load_pem_x509_certificate(data)
 
+def certs_from_pem(data: bytes) -> List[Certificate]:
+    return x509.load_pem_x509_certificates(data)
+
+def cert_to_der(cert):
+    return cert.public_bytes(serialization.Encoding.DER)
 
 def cert_to_pem(cert):
     return cert.public_bytes(serialization.Encoding.PEM)

{certapi-0.2.2 → certapi-0.2.4}/src/certapi/db.py

@@ -21,7 +21,7 @@ class KeyStore(ABC):
         pass
 
     @abstractmethod
-    def save_cert(self, private_key_id: int, cert: Certificate, domains: List[str], name: str = None) -> int:
+    def save_cert(self, private_key_id: int, cert: Certificate|str, domains: List[str], name: str = None) -> int:
         pass
 
     @abstractmethod
@@ -91,12 +91,12 @@ class SqliteKeyStore(KeyStore):
         self.save_key(key, name)
         return key
 
-    def save_cert(self, private_key_id: int, cert: Certificate, domains: List[str], name: str = None) -> int:
+    def save_cert(self, private_key_id: int, cert: Certificate|str, domains: List[str], name: str = None) -> int:
         conn = self._get_db_connection()
         cur = conn.cursor()
         cur.execute(
             "INSERT INTO certificates (name, priv_id, content) VALUES (?, ?, ?)",
-            (name, private_key_id, cert.public_bytes(serialization.Encoding.DER)),
+            (name, private_key_id, cert_to_der(cert)),
         )
         cert_id = cur.lastrowid
 
@@ -182,32 +182,42 @@ class FilesystemKeyStore(KeyStore):
             return cert_from_pem(cert_data)
         return None
 
-    def save_cert(self, private_key_id: str, cert: Certificate, domains: list, name: str = None) -> int:
+
+    def save_cert(self, private_key_id: str, cert: Certificate | str, domains: list, name: str = None) -> int:
+        def get_cert_pem(cert) -> bytes:
+            return cert.encode() if isinstance(cert, str) else cert_to_pem(cert)
+
+        cert_pem = get_cert_pem(cert)
+
         if name:
             cert_path = os.path.join(self.certs_dir, f"{name}.crt")
             with open(cert_path, "wb") as f:
-                f.write(cert_to_pem(cert))
+                f.write(cert_pem)
+
         key_content = None
         key_path = os.path.join(self.keys_dir, f"{private_key_id}.key")
         with open(key_path, "rb") as f:
             key_content = f.read()
-        
+
         for domain in domains:
+            domain_name = domain
             if name is not None and name.endswith(".selfsigned"):
-                domain = domain + ".selfsigned"
+                domain_name += ".selfsigned"
 
-            if domain != private_key_id:
-                with open(os.path.join(self.keys_dir, f"{domain}.key"), "wb") as f:
+            if domain_name != private_key_id:
+                with open(os.path.join(self.keys_dir, f"{domain_name}.key"), "wb") as f:
                     f.write(key_content)
-            domain_cert_path = os.path.join(self.certs_dir, f"{domain}.crt")
+
+            domain_cert_path = os.path.join(self.certs_dir, f"{domain_name}.crt")
             with open(domain_cert_path, "wb") as f:
-                f.write(cert_to_pem(cert))
+                f.write(cert_pem)
+
 
         return name if name else domains[0]  # Dummy ID since filesystem does not use numeric IDs
 
-    def get_cert(self, domain: str) -> None | Tuple[str, Key, Certificate]:
-        cert_path = os.path.join(self.certs_dir, f"{domain}.crt")
-        key_path = os.path.join(self.keys_dir, f"{domain}.key")
+    def get_cert(self, name: str) -> None | Tuple[str, Key, Certificate]:
+        cert_path = os.path.join(self.certs_dir, f"{name}.crt")
+        key_path = os.path.join(self.keys_dir, f"{name}.key")
         key = None
         cert = None
         if os.path.exists(key_path):
@@ -226,7 +236,7 @@ class FilesystemKeyStore(KeyStore):
 
         if cert is None or key is None:
             return None
-        return (domain, key, cert)
+        return (name, key, cert)
 
 
 class PostgresKeyStore(KeyStore):

certapi-0.2.4/src/certapi/digitalocean_challenge_store.py

@@ -0,0 +1,57 @@
+import os
+from collections.abc import MutableMapping
+from certapi.challenge import ChallengeStore
+from certapi.digitalocean_client import DigitalOcean
+
+
+class DigitalOceanChallengeStore(ChallengeStore):
+    def __init__(self):
+        self.digitalocean = DigitalOcean()
+        self.challenges_map = {}  # Stores key: record_id (needed for deletion)
+
+    def has_domain(self, domain: str) -> bool:
+        """
+        Checks if the DigitalOcean account has access to the given domain (or its base domain)
+        as a registered zone.
+        """
+        try:
+            self.digitalocean.determine_domain(domain)
+            return True
+        except Exception:
+            return False
+
+    def save_challenge(self, key: str, value: str, domain=None):
+        # key example: _acme-challenge.sub.example.com
+        # value example: ACME_CHALLENGE_TOKEN
+        base_domain = self.digitalocean.determine_domain(domain)
+
+        record_id = self.digitalocean.create_record(name=key, data=value, domain=base_domain)
+        self.challenges_map[key] = record_id
+        print(f"DigitalOceanChallengeStore: Saved challenge for {key} with record ID {record_id}")
+
+    def get_challenge(self, key: str, domain: str) -> str:
+        base_domain = self.digitalocean.determine_domain(domain)
+        records = self.digitalocean.list_records(base_domain, name_filter=key)
+        for record in records:
+            if record["name"] == key:
+                return record["data"] # DigitalOcean API returns 'data' for TXT record content
+        return None  # Return None if not found, as per ChallengeStore's __getitem__ behavior
+
+    def delete_challenge(self, key: str, domain: str):
+        if key not in self.challenges_map:
+            raise KeyError(f"Challenge {key} not found in store (no record_id stored).")
+
+        record_id = self.challenges_map[key]
+        base_domain = self.digitalocean.determine_domain(domain)
+        self.digitalocean.delete_record(record=record_id, domain=base_domain)
+        del self.challenges_map[key]
+        print(f"DigitalOceanChallengeStore: Deleted challenge for {key} with record ID {record_id}")
+
+    def __iter__(self):
+        # This is tricky as we can't easily iterate all challenges across all domains
+        # If the user wants a full API-driven iteration, they need to clarify how to get all domains.
+        return iter(self.challenges_map)
+
+    def __len__(self):
+        # Similar to __iter__, this will count challenges managed by this store instance.
+        return len(self.challenges_map)

certapi-0.2.4/src/certapi/digitalocean_client.py

@@ -0,0 +1,86 @@
+import json
+from os import getenv
+
+from urllib.request import urlopen, Request  # Python 3
+
+
+
+class DigitalOcean(object):
+    def __init__(self,api_key=None):
+        self.token=api_key
+        self.api = "https://api.digitalocean.com/v2/domains"
+        if not self.token:
+            self.token = getenv("DIGITALOCEAN_API_TOKEN")
+            if not self.token:
+                raise Exception("API_TOKEN not found in environment")
+
+    def determine_domain(self, domain):
+        """Determine registered domain in API"""
+        request_headers = {"Content-Type": "application/json", "Authorization": "Bearer {0}".format(self.token)}
+        response = urlopen(Request(self.api, headers=request_headers))
+        if response.getcode() != 200:
+            raise Exception(json.loads(response.read().decode("utf8")))
+        domains = json.loads(response.read().decode("utf8"))["domains"]
+        for d in domains:
+            if d["name"] in domain:
+                return d["name"]
+
+    def create_record(self, name, data, domain):
+        """
+        Create DNS record
+        Params:
+            name, string, record name
+            data, string, record data
+            domain, string, dns domain
+        Return:
+            record_id, int, created record id
+        """
+        registered_domain = self.determine_domain(domain)
+        api = self.api + "/" + registered_domain + "/records"
+        request_headers = {"Content-Type": "application/json", "Authorization": "Bearer {0}".format(self.token)}
+        request_data = {"type": "TXT", "ttl": 300, "name": name, "data": data}
+        response = urlopen(Request(api, data=json.dumps(request_data).encode("utf8"), headers=request_headers))
+        if response.getcode() != 201:
+            raise Exception(json.loads(response.read().decode("utf8")))
+        return json.loads(response.read().decode("utf8"))["domain_record"]["id"]
+
+    def delete_record(self, record, domain):
+        """
+        Delete DNS record
+        Params:
+            record, int, record id number
+            domain, string, dns domain
+        """
+        registered_domain = self.determine_domain(domain)
+        api = self.api + "/" + registered_domain + "/records/" + str(record)
+        request_headers = {"Content-Type": "application/json", "Authorization": "Bearer {0}".format(self.token)}
+        request = Request(api, data=json.dumps({}).encode("utf8"), headers=request_headers)
+        request.get_method = lambda: "DELETE"
+        response = urlopen(request)
+        if response.getcode() != 204:
+            raise Exception(json.loads(response.read().decode("utf8")))
+
+    def list_records(self, domain, name_filter=None):
+        """
+        List DNS records for a domain, optionally filtered by name.
+        Params:
+            domain, string, dns domain
+            name_filter, string, optional filter for record name
+        Return:
+            records, list of dicts, matching DNS records
+        """
+        registered_domain = self.determine_domain(domain)
+        api = self.api + "/" + registered_domain + "/records"
+        request_headers = {"Content-Type": "application/json", "Authorization": "Bearer {0}".format(self.token)}
+        response = urlopen(Request(api, headers=request_headers))
+        if response.getcode() != 200:
+            raise Exception(json.loads(response.read().decode("utf8")))
+        
+        all_records = json.loads(response.read().decode("utf8"))["domain_records"]
+        
+        if name_filter:
+            filtered_records = [r for r in all_records if r["name"] == name_filter and r["type"] == "TXT"]
+        else:
+            filtered_records = [r for r in all_records if r["type"] == "TXT"]
+            
+        return filtered_records

{certapi-0.2.2 → certapi-0.2.4}/src/certapi.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: certapi
-Version: 0.2.2
+Version: 0.2.4
 Summary: Python Package for managing keys, request SSL certificates from ACME.
 Home-page: https://github.com/mesudip/certapi
 Author: Sudip Bhattarai
@@ -16,6 +16,8 @@ Description-Content-Type: text/markdown
 CertApi is a Python package for requesting SSL certificates from ACME.
 This is supposed to be used as a base library for building other tools, or to integrate Certificate creation feature in you app.
 
+> ⚠️ Warning: This project is not polished for production use. Please stay tuned for the LTS `v1.0.0` release.
+
 ## Installation
 
 You can install CertApi using pip:

{certapi-0.2.2 → certapi-0.2.4}/src/certapi.egg-info/SOURCES.txt

@@ -12,6 +12,8 @@ src/certapi/crypto.py
 src/certapi/crypto_classes.py
 src/certapi/custom_certauthority.py
 src/certapi/db.py
+src/certapi/digitalocean_challenge_store.py
+src/certapi/digitalocean_client.py
 src/certapi/util.py
 src/certapi.egg-info/PKG-INFO
 src/certapi.egg-info/SOURCES.txt