Add preliminary dynamically generated CRLs on fetching CA CRL

backend/src/services/certificate/certificate-fns.ts

@@ -0,0 +1,26 @@
+import * as x509 from "@peculiar/x509";
+
+import { CrlReason } from "./certificate-types";
+
+export const revocationReasonToCrlCode = (crlReason: CrlReason) => {
+  switch (crlReason) {
+    case CrlReason.KEY_COMPROMISE:
+      return x509.X509CrlReason.keyCompromise;
+    case CrlReason.CA_COMPROMISE:
+      return x509.X509CrlReason.cACompromise;
+    case CrlReason.AFFILIATION_CHANGED:
+      return x509.X509CrlReason.affiliationChanged;
+    case CrlReason.SUPERSEDED:
+      return x509.X509CrlReason.superseded;
+    case CrlReason.CESSATION_OF_OPERATION:
+      return x509.X509CrlReason.cessationOfOperation;
+    case CrlReason.CERTIFICATE_HOLD:
+      return x509.X509CrlReason.certificateHold;
+    case CrlReason.PRIVILEGE_WITHDRAWN:
+      return x509.X509CrlReason.privilegeWithdrawn;
+    case CrlReason.A_A_COMPROMISE:
+      return x509.X509CrlReason.aACompromise;
+    default:
+      return x509.X509CrlReason.unspecified;
+  }
+};

backend/src/services/certificate/certificate-service.ts

@@ -7,10 +7,11 @@ import { TCertificateCertDALFactory } from "@app/services/certificate/certificat
 import { TCertificateDALFactory } from "@app/services/certificate/certificate-dal";
 import { TCertificateAuthorityDALFactory } from "@app/services/certificate-authority/certificate-authority-dal";
 
-import { TDeleteCertDTO, TGetCertCertDTO, TGetCertDTO, TRevokeCertDTO } from "./certificate-types";
+import { revocationReasonToCrlCode } from "./certificate-fns";
+import { CertStatus, TDeleteCertDTO, TGetCertCertDTO, TGetCertDTO, TRevokeCertDTO } from "./certificate-types";
 
 type TCertificateServiceFactoryDep = {
-  certificateDAL: Pick<TCertificateDALFactory, "findOne" | "deleteById">;
+  certificateDAL: Pick<TCertificateDALFactory, "findOne" | "deleteById" | "update">;
   certificateCertDAL: Pick<TCertificateCertDALFactory, "findOne">;
   certificateAuthorityDAL: Pick<TCertificateAuthorityDALFactory, "findById">;
   permissionService: Pick<TPermissionServiceFactory, "getProjectPermission">;
@@ -59,7 +60,14 @@ export const certificateServiceFactory = ({
     return deletedCert;
   };
 
-  const revokeCert = async ({ serialNumber, actorId, actorAuthMethod, actor, actorOrgId }: TRevokeCertDTO) => {
+  const revokeCert = async ({
+    serialNumber,
+    revocationReason,
+    actorId,
+    actorAuthMethod,
+    actor,
+    actorOrgId
+  }: TRevokeCertDTO) => {
     const cert = await certificateDAL.findOne({ serialNumber });
     const ca = await certificateAuthorityDAL.findById(cert.caId);
 
@@ -72,14 +80,22 @@ export const certificateServiceFactory = ({
     );
 
     ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Delete, ProjectPermissionSub.Certificates);
-    // WIP
 
-    // const revocationDate = new Date();
+    if (cert.status === CertStatus.REVOKED) throw new Error("Certificate already revoked");
 
-    // const serialNumber2 = crypto.randomBytes(16).toString("hex");
-    // const crlEntry = new x509.X509CrlEntry(serialNumber2, new Date(), []);
+    const revokedAt = new Date();
+    await certificateDAL.update(
+      {
+        id: cert.id
+      },
+      {
+        status: CertStatus.REVOKED,
+        revokedAt,
+        revocationReason: revocationReasonToCrlCode(revocationReason)
+      }
+    );
 
-    return {};
+    return { revokedAt };
   };
 
   const getCertCert = async ({ serialNumber, actorId, actorAuthMethod, actor, actorOrgId }: TGetCertCertDTO) => {

backend/src/services/certificate/certificate-types.ts

@@ -1,10 +1,30 @@
 import { TProjectPermission } from "@app/lib/types";
 
-export enum TCertStatus {
+export enum CertStatus {
   ACTIVE = "active",
   REVOKED = "revoked"
 }
 
+export enum CertKeyAlgorithm {
+  RSA_2048 = "RSA_2048",
+  RSA_4096 = "RSA_4096",
+  ECDSA_P256 = "EC_prime256v1",
+  ECDSA_P384 = "EC_secp384r1"
+}
+
+export enum CrlReason {
+  UNSPECIFIED = "UNSPECIFIED",
+  KEY_COMPROMISE = "KEY_COMPROMISE",
+  CA_COMPROMISE = "CA_COMPROMISE",
+  AFFILIATION_CHANGED = "AFFILIATION_CHANGED",
+  SUPERSEDED = "SUPERSEDED",
+  CESSATION_OF_OPERATION = "CESSATION_OF_OPERATION",
+  CERTIFICATE_HOLD = "CERTIFICATE_HOLD",
+  // REMOVE_FROM_CRL = "REMOVE_FROM_CRL",
+  PRIVILEGE_WITHDRAWN = "PRIVILEGE_WITHDRAWN",
+  A_A_COMPROMISE = "A_A_COMPROMISE"
+}
+
 export type TGetCertDTO = {
   serialNumber: string;
 } & Omit<TProjectPermission, "projectId">;
@@ -15,6 +35,7 @@ export type TDeleteCertDTO = {
 
 export type TRevokeCertDTO = {
   serialNumber: string;
+  revocationReason: CrlReason;
 } & Omit<TProjectPermission, "projectId">;
 
 export type TGetCertCertDTO = {