tiny-ca-gateway 0.1.0__py3-none-any.whl

tiny_ca_gateway/core/base_manager.py

@@ -0,0 +1,162 @@
+"""
+Contains all startup/shutdown/rebuild business logic.
+Each framework inherits and adds only its own specifics:
+- Flask: init_sync()
+- Django: ready() hook
+- FastAPI: already async, just uses as-is
+- aiohttp: cleanup_ctx, uses as-is
+"""
+
+from __future__ import annotations
+
+import logging
+from pathlib import Path
+import shutil
+
+from tiny_ca import CAConfig, CAFileLoader, CertificateFactory
+from tiny_ca.managers.async_lifecycle_manager import AsyncCertLifecycleManager
+
+from tiny_ca_gateway.db import LocalDBHandler
+from tiny_ca_gateway.models import API_SETTINGS
+from tiny_ca_gateway.utils.singleton import SingletonMeta
+
+LOGGER = logging.getLogger("tiny-ca")
+
+
+class BaseCAManager(metaclass=SingletonMeta):
+    """
+    Singleton base CA manager.
+
+    Subclass per framework and override ``_make_exception`` if the
+    framework uses a custom HTTP exception type.
+
+    Usage::
+
+        class FlaskCAManager(BaseCAManager):
+            pass
+
+        class MyCAManager(BaseCAManager):
+            _logger_name = "my-app-ca"
+    """
+
+    _manager: AsyncCertLifecycleManager
+    _logger_name: str = "tiny-ca"
+
+    def __init__(
+        self,
+        logger: logging.Logger | None = None,
+        common_name: str = "Root CA",
+        organization: str = "Organization",
+    ) -> None:
+        self._logger = logger or logging.getLogger(self._logger_name)
+        self._common_name = common_name
+        self._organization = organization
+        self._db_handler = LocalDBHandler(
+            API_SETTINGS.db_url,
+            logger=self._logger,
+        )
+
+    # ------------------------------------------------------------------
+    # Properties
+    # ------------------------------------------------------------------
+
+    @property
+    def manager(self) -> AsyncCertLifecycleManager:
+        return self._manager
+
+    @property
+    def logger(self) -> logging.Logger:
+        return self._logger
+
+    # ------------------------------------------------------------------
+    # Internal async machinery
+    # ------------------------------------------------------------------
+
+    async def _rebuild_root_ca_pair(self, ca_config: CAConfig) -> None:
+        """Generate a new self-signed root CA and write to disk."""
+        tmp = AsyncCertLifecycleManager(
+            db_handler=self._db_handler, logger=self._logger
+        )
+        ca_cert_path, ca_key_path = await tmp.create_self_signed_ca(
+            config=ca_config, is_overwrite=True
+        )
+        self._logger.warning("Generated new self-signed root CA.")
+        shutil.copy(ca_cert_path, API_SETTINGS.path_to_ca_cer)
+        shutil.copy(ca_key_path, API_SETTINGS.path_to_ca_key)
+
+    async def _rebuild_manager(self) -> None:
+        """(Re-)load the CA factory from disk."""
+        self._manager = AsyncCertLifecycleManager(
+            db_handler=self._db_handler,
+            factory=CertificateFactory(
+                ca_loader=CAFileLoader(
+                    ca_cert_path=API_SETTINGS.path_to_ca_cer,
+                    ca_key_path=API_SETTINGS.path_to_ca_key,
+                    logger=self._logger,
+                ),
+                logger=self._logger,
+            ),
+        )
+
+    # ------------------------------------------------------------------
+    # Public lifecycle API
+    # ------------------------------------------------------------------
+
+    async def on_startup(self) -> None:
+        """Bootstrap DB, create CA if missing, load factory."""
+        await self._db_handler._db.init_db()
+        await self._db_handler.init_system_time_if_empty()
+
+        if not Path(API_SETTINGS.path_to_ca_cer).exists():
+            await self._rebuild_root_ca_pair(
+                CAConfig(
+                    common_name=self._common_name,
+                    organization=self._organization,
+                    country="UA",
+                    key_size=4096,
+                    days_valid=3650,
+                )
+            )
+        await self._rebuild_manager()
+        self._logger.info("✓ CA initialised.")
+
+    async def on_shutdown(self) -> None:
+        """Graceful shutdown hook (no-op by default)."""
+        pass
+
+    # ------------------------------------------------------------------
+    # Called from POST /root endpoint
+    # ------------------------------------------------------------------
+
+    async def rebuild_root_ca_pair(self, ca_config: CAConfig) -> None:
+        await self._rebuild_root_ca_pair(ca_config)
+
+    async def rebuild_manager(self) -> None:
+        await self._rebuild_manager()
+
+    # ------------------------------------------------------------------
+    # Sync bootstrap (Flask / Django WSGI)
+    # ------------------------------------------------------------------
+
+    def init_sync(self) -> None:
+        """
+        Run on_startup() synchronously.
+
+        Use in WSGI contexts (Flask create_app, Django AppConfig.ready).
+        Safe to call even if an async loop is already running — in that
+        case the call is a no-op and the ASGI lifespan handler takes over.
+        """
+        import asyncio
+
+        try:
+            loop = asyncio.get_running_loop()
+        except RuntimeError:
+            loop = None
+
+        if loop and loop.is_running():
+            self._logger.debug(
+                "Async loop running — CA init delegated to ASGI lifespan."
+            )
+            return
+
+        asyncio.run(self.on_startup())

tiny_ca_gateway/core/helpers.py

@@ -0,0 +1,110 @@
+from __future__ import annotations
+
+import logging
+from pathlib import Path
+from typing import TYPE_CHECKING
+
+from cryptography import x509
+
+from tiny_ca_gateway.core.schemas import (
+    ArtifactType,
+    CertListItem,
+    IssueCertRequest,
+)
+from tiny_ca_gateway.models import API_SETTINGS
+
+if TYPE_CHECKING:
+    from tiny_ca.models.certificate import ClientConfig
+
+LOGGER = logging.getLogger("tiny-ca")
+
+
+# ---------------------------------------------------------------------------
+# Record → schema
+# ---------------------------------------------------------------------------
+
+
+def record_to_item(r: object) -> CertListItem:
+    """Convert a DB record to a CertListItem schema."""
+    return CertListItem(
+        serial_number=r.serial_number,  # type: ignore[attr-defined]
+        common_name=r.common_name,  # type: ignore[attr-defined]
+        status=r.status,  # type: ignore[attr-defined]
+        key_type=r.key_type,  # type: ignore[attr-defined]
+        not_valid_after=r.not_valid_after,  # type: ignore[attr-defined]
+        uuid=r.uuid,  # type: ignore[attr-defined]
+    )
+
+
+# ---------------------------------------------------------------------------
+# File system
+# ---------------------------------------------------------------------------
+
+
+async def get_artifact_path(uuid: str, object_type: ArtifactType) -> Path | None:
+    """
+    Return the path to ``<certs_dir>/<uuid>/<any_name>.<object_type>``
+    or ``None`` if not found.
+
+    tiny_ca stores files as ``<common_name>.<ext>`` inside a UUID folder,
+    so we scan by extension rather than assuming a fixed filename.
+    """
+    folder = Path(API_SETTINGS.path_to_certificates_folder) / uuid
+    if not folder.is_dir():
+        LOGGER.debug("Artifact folder not found: %s", folder)
+        return None
+    ext = f".{object_type}"
+    for f in folder.iterdir():
+        if f.is_file() and f.suffix == ext:
+            return f
+    return None
+
+
+# ---------------------------------------------------------------------------
+# PEM loaders  (raise ValueError — caller converts to HTTP error)
+# ---------------------------------------------------------------------------
+
+
+def load_pem_cert(pem: str) -> x509.Certificate:
+    """Parse PEM certificate; raises ValueError on failure."""
+    try:
+        return x509.load_pem_x509_certificate(pem.encode())
+    except Exception as exc:
+        raise ValueError(f"Invalid PEM certificate: {exc}") from exc
+
+
+def load_pem_crl(pem: str) -> x509.CertificateRevocationList:
+    """Parse PEM CRL; raises ValueError on failure."""
+    try:
+        return x509.load_pem_x509_crl(pem.encode())
+    except Exception as exc:
+        raise ValueError(f"Invalid PEM CRL: {exc}") from exc
+
+
+# ---------------------------------------------------------------------------
+# ClientConfig builder  (issue / rotate share identical logic)
+# ---------------------------------------------------------------------------
+
+
+def build_client_config(payload: IssueCertRequest) -> ClientConfig:
+    """
+    Build a ``ClientConfig`` from an ``IssueCertRequest``.
+
+    Centralises the payload → config mapping that was copy-pasted
+    in every framework's issue and rotate handlers.
+    """
+    from tiny_ca.const import CertType
+    from tiny_ca.models.certificate import ClientConfig
+
+    return ClientConfig(
+        common_name=payload.common_name,
+        serial_type=CertType.SERVICE,
+        key_size=payload.key_size,
+        days_valid=payload.days_valid,
+        valid_from=payload.valid_from,
+        email=payload.email,
+        is_server_cert=payload.is_server_cert,
+        is_client_cert=payload.is_client_cert,
+        san_dns=payload.san_dns,
+        san_ip=[str(ip) for ip in payload.san_ip] if payload.san_ip else None,
+    )

tiny_ca_gateway/core/routes.py

@@ -0,0 +1,41 @@
+from enum import StrEnum
+
+
+class Routes(StrEnum):
+    # Public
+    GET_PUBLIC_CERT = "/cert"
+    BASE_CRL = "/crl"
+
+    # Lists
+    GET_LIST_CERTS = ""
+    GET_LIST_EXPIRING_CERTS = "/expiring"
+
+    # CA bootstrap
+    CA_ROOT = "/root"
+    CA_INTERMEDIATE = "/intermediate"
+
+    # Issuance
+    ISSUE = "/issue"
+
+    # File downloads
+    DOWNLOAD = "/{uuid_certificate}"
+    DOWNLOAD_STREAM = "/stream/{uuid_certificate}"
+
+    # Maintenance
+    MAINTENANCE_EXPIRE = "/maintenance/expire"
+
+    # CRL
+    CRL_REFRESH = "/crl/refresh"
+    CRL_VERIFY = "/crl/verify"
+
+    # Operations
+    VERIFY = "/verify"
+    COSIGN = "/cosign"
+    EXPORT = "/export-p12/{serial}"
+    REVOKE = "/revoke"
+    ROTATE = "/rotate/{serial}"
+    RENEW = "/renew/{serial}"
+    DELETE = "/{serial}"
+    STATUS = "/status/{serial}"
+    INSPECT = "/inspect/{serial}"
+    CHAIN = "/chain/{serial}"

tiny_ca_gateway/core/schemas.py

@@ -0,0 +1,179 @@
+from __future__ import annotations
+
+import datetime
+from typing import Literal
+
+from cryptography import x509 as _x509
+from pydantic import BaseModel, Field
+
+# ---------------------------------------------------------------------------
+# Reason map
+# ---------------------------------------------------------------------------
+
+REASON_MAP: dict[str, _x509.ReasonFlags] = {
+    "unspecified": _x509.ReasonFlags.unspecified,
+    "keyCompromise": _x509.ReasonFlags.key_compromise,
+    "cACompromise": _x509.ReasonFlags.ca_compromise,
+    "affiliationChanged": _x509.ReasonFlags.affiliation_changed,
+    "superseded": _x509.ReasonFlags.superseded,
+    "cessationOfOperation": _x509.ReasonFlags.cessation_of_operation,
+    "certificateHold": _x509.ReasonFlags.certificate_hold,
+    "removeFromCRL": _x509.ReasonFlags.remove_from_crl,
+    "privilegeWithdrawn": _x509.ReasonFlags.privilege_withdrawn,
+    "aACompromise": _x509.ReasonFlags.aa_compromise,
+}
+
+ArtifactType = Literal["pem", "key", "csr"]
+
+# ---------------------------------------------------------------------------
+# Response schemas
+# ---------------------------------------------------------------------------
+
+
+class CertListItem(BaseModel):
+    serial_number: str
+    common_name: str
+    status: str
+    key_type: str | None
+    not_valid_after: datetime.datetime
+    uuid: str | None
+
+
+class ExpiringResponse(BaseModel):
+    within_days: int
+    count: int
+    certificates: list[CertListItem]
+
+
+class CreateRootCaResponse(BaseModel):
+    ca_id: str = Field(description="Storage UUID of the new CA.")
+    expires_at: str = ""
+
+
+class IssueCertResponse(BaseModel):
+    uuid: str
+    serial_number: int
+    common_name: str
+    not_valid_before: datetime.datetime
+    not_valid_after: datetime.datetime
+
+
+class MaintenanceResponse(BaseModel):
+    updated: int
+
+
+class VerifyResponse(BaseModel):
+    valid: bool
+    detail: str = ""
+
+
+class CRLRefreshResponse(BaseModel):
+    next_update: datetime.datetime
+
+
+class RevokeResponse(BaseModel):
+    revoked: bool
+    serial_number: int
+
+
+class DeleteResponse(BaseModel):
+    deleted: bool
+    serial: int
+
+
+class StatusResponse(BaseModel):
+    serial: int
+    status: str
+
+
+class RenewResponse(BaseModel):
+    old_serial: int
+    new_serial: int
+    not_valid_after: datetime.datetime
+
+
+class CosignResponse(BaseModel):
+    serial_number: int
+    not_valid_before: datetime.datetime
+    not_valid_after: datetime.datetime
+    pem: str
+
+
+class ChainResponse(BaseModel):
+    serial: int
+    chain_length: int
+    chain: list[str]
+
+
+class RotateResponse(BaseModel):
+    uuid: str
+    serial_number: int
+    common_name: str
+    not_valid_before: datetime.datetime
+    not_valid_after: datetime.datetime
+
+
+# ---------------------------------------------------------------------------
+# Request schemas
+# ---------------------------------------------------------------------------
+
+
+class IntermediateCARequest(BaseModel):
+    common_name: str
+    key_size: int = Field(default=4096, ge=2048, le=8192)
+    days_valid: int = Field(default=1825, ge=1, le=36500)
+    path_length: int | None = 0
+    organization: str | None = None
+    country: str | None = "UA"
+
+
+class IssueCertRequest(BaseModel):
+    common_name: str
+    key_size: int = Field(default=2048, ge=1024, le=8192)
+    days_valid: int = Field(default=365, ge=1, le=36500)
+    valid_from: datetime.datetime | None = None
+    email: str | None = None
+    is_server_cert: bool = False
+    is_client_cert: bool = False
+    san_dns: list[str] | None = None
+    san_ip: list[str] | None = None
+    is_overwrite: bool = False
+
+
+class CRLVerifyRequest(BaseModel):
+    pem: str = Field(description="PEM-encoded CRL.")
+
+
+class CRLVerifyResponse(BaseModel):
+    valid: bool
+    detail: str = ""
+    next_update: str = ""
+
+
+class VerifyRequest(BaseModel):
+    pem: str = Field(description="PEM-encoded X.509 certificate.")
+
+
+class CosignRequest(BaseModel):
+    pem: str = Field(description="PEM-encoded certificate to co-sign.")
+    days_valid: int | None = None
+    valid_from: datetime.datetime | None = None
+
+
+class ExportP12Request(BaseModel):
+    password: str | None = Field(
+        default=None,
+        description="Passphrase to encrypt the PKCS#12 bundle.",
+    )
+
+
+class RevokeRequest(BaseModel):
+    serial_number: int
+    reason: str = Field(
+        default="unspecified",
+        description="unspecified | keyCompromise | cACompromise | ...",
+    )
+
+
+class RenewRequest(BaseModel):
+    days_valid: int = Field(default=365, ge=1, le=36500)

tiny_ca_gateway/core/summary.py

@@ -0,0 +1,26 @@
+from enum import StrEnum
+
+
+class RoutesSummary(StrEnum):
+    DOWNLOAD = "Download certificate artefact (pem / key / csr)"
+    DOWNLOAD_STREAM = "Stream certificate artefact"
+    CHAIN = "Full PEM certificate chain [leaf, ca]"
+    INSPECT = "Structured certificate details"
+    STATUS = "Get certificate lifecycle status"
+    DELETE = "Hard-delete certificate from DB and storage"
+    RENEW = "Renew certificate (same key, new validity)"
+    ROTATE = "Rotate certificate (revoke + re-issue with new key)"
+    REVOKE = "Revoke a certificate"
+    EXPORT = "Export PKCS#12 (.p12) bundle"
+    CRL_VERIFY = "Verify CRL signature and expiry"
+    COSIGN = "Co-sign a third-party certificate with this CA"
+    VERIFY = "Verify certificate (chain + signature + revocation)"
+    CRL_REFRESH = "Force-regenerate the CRL"
+    MAINTENANCE_EXPIRE = "Bulk-mark expired certificates"
+    ISSUE = "Issue leaf certificate"
+    CA_INTERMEDIATE = "Issue intermediate CA certificate"
+    CA_ROOT = "Bootstrap self-signed root CA"
+    GET_LIST_EXPIRING_CERTS = "Certificates expiring soon"
+    GET_LIST_CERTS = "List certificates"
+    BASE_CRL = "Download the current CRL (public, no auth)"
+    GET_PUBLIC_CERT = "Download CA public certificate (no auth)"

tiny_ca_gateway/db.py

@@ -0,0 +1,63 @@
+import datetime
+from logging import INFO, Logger, getLogger
+
+from sqlalchemy import (
+    Boolean,
+    Column,
+    DateTime,
+    ForeignKey,
+    Integer,
+    LargeBinary,
+    String,
+    delete,
+    select,
+)
+from sqlalchemy.ext.asyncio import AsyncSession, async_sessionmaker, create_async_engine
+from tiny_ca.db.async_db_manager import AsyncDBHandler
+from tiny_ca.db.models import Base
+
+from tiny_ca_gateway.models import API_SETTINGS
+
+
+class SystemSettings(Base):
+    __tablename__ = "system_settings"
+    id = Column(Integer, primary_key=True)
+
+    internal_token_valid_until = Column(DateTime)
+
+
+class LocalDBHandler(AsyncDBHandler):
+    async def get_system_init_time(self) -> SystemSettings | None:
+        async with self._db.get_session() as session:
+            stmt = select(SystemSettings)
+
+            result = await session.execute(stmt)
+            cert = result.scalar_one_or_none()
+
+            return cert  # type: ignore[no-any-return]
+
+    async def _init_sys_time(self) -> None:
+        async with self._db.get_session() as session:
+            try:
+                internal_token_valid_until = (
+                    datetime.datetime.now()
+                    + datetime.timedelta(minutes=API_SETTINGS.ttl_token)
+                )
+
+                new_cert = SystemSettings(
+                    internal_token_valid_until=internal_token_valid_until
+                )
+                session.add(new_cert)
+                API_SETTINGS.internal_token_valid_until = internal_token_valid_until
+                await session.commit()
+            except Exception:
+                self._logger.warning("Can't save init time")
+
+    async def init_system_time_if_empty(self) -> None:
+        sys_settings = await self.get_system_init_time()
+        if sys_settings is None:
+            await self._init_sys_time()
+        else:
+            API_SETTINGS.internal_token_valid_until = (
+                sys_settings.internal_token_valid_until  # type: ignore
+            )