Merge pull request #4286 from Infisical/ENG-3376

feat(app-connections, PKI): Cloudflare as DNS provider

backend/src/server/routes/v1/app-connection-routers/cloudflare-connection-router.ts

@@ -46,7 +46,6 @@ export const registerCloudflareConnectionRouter = async (server: FastifyZodProvi
       const { connectionId } = req.params;
 
       const projects = await server.services.appConnection.cloudflare.listPagesProjects(connectionId, req.permission);
-
       return projects;
     }
   });
@@ -73,9 +72,36 @@ export const registerCloudflareConnectionRouter = async (server: FastifyZodProvi
     handler: async (req) => {
       const { connectionId } = req.params;
 
-      const projects = await server.services.appConnection.cloudflare.listWorkersScripts(connectionId, req.permission);
+      const scripts = await server.services.appConnection.cloudflare.listWorkersScripts(connectionId, req.permission);
+      return scripts;
+    }
+  });
 
-      return projects;
+  server.route({
+    method: "GET",
+    url: `/:connectionId/cloudflare-zones`,
+    config: {
+      rateLimit: readLimit
+    },
+    schema: {
+      params: z.object({
+        connectionId: z.string().uuid()
+      }),
+      response: {
+        200: z
+          .object({
+            id: z.string(),
+            name: z.string()
+          })
+          .array()
+      }
+    },
+    onRequest: verifyAuth([AuthMode.JWT]),
+    handler: async (req) => {
+      const { connectionId } = req.params;
+
+      const zones = await server.services.appConnection.cloudflare.listZones(connectionId, req.permission);
+      return zones;
     }
   });
 };

backend/src/services/app-connection/cloudflare/cloudflare-connection-fns.ts

@@ -10,7 +10,8 @@ import {
   TCloudflareConnection,
   TCloudflareConnectionConfig,
   TCloudflarePagesProject,
-  TCloudflareWorkersScript
+  TCloudflareWorkersScript,
+  TCloudflareZone
 } from "./cloudflare-connection-types";
 
 export const getCloudflareConnectionListItem = () => {
@@ -66,6 +67,27 @@ export const listCloudflareWorkersScripts = async (
   }));
 };
 
+export const listCloudflareZones = async (appConnection: TCloudflareConnection): Promise<TCloudflareZone[]> => {
+  const {
+    credentials: { apiToken }
+  } = appConnection;
+
+  const { data } = await request.get<{ result: { name: string; id: string }[] }>(
+    `${IntegrationUrls.CLOUDFLARE_API_URL}/client/v4/zones`,
+    {
+      headers: {
+        Authorization: `Bearer ${apiToken}`,
+        Accept: "application/json"
+      }
+    }
+  );
+
+  return data.result.map((a) => ({
+    name: a.name,
+    id: a.id
+  }));
+};
+
 export const validateCloudflareConnectionCredentials = async (config: TCloudflareConnectionConfig) => {
   const { apiToken, accountId } = config.credentials;
 

backend/src/services/app-connection/cloudflare/cloudflare-connection-service.ts

@@ -2,7 +2,11 @@ import { logger } from "@app/lib/logger";
 import { OrgServiceActor } from "@app/lib/types";
 
 import { AppConnection } from "../app-connection-enums";
-import { listCloudflarePagesProjects, listCloudflareWorkersScripts } from "./cloudflare-connection-fns";
+import {
+  listCloudflarePagesProjects,
+  listCloudflareWorkersScripts,
+  listCloudflareZones
+} from "./cloudflare-connection-fns";
 import { TCloudflareConnection } from "./cloudflare-connection-types";
 
 type TGetAppConnectionFunc = (
@@ -16,7 +20,6 @@ export const cloudflareConnectionService = (getAppConnection: TGetAppConnectionF
     const appConnection = await getAppConnection(AppConnection.Cloudflare, connectionId, actor);
     try {
       const projects = await listCloudflarePagesProjects(appConnection);
-
       return projects;
     } catch (error) {
       logger.error(
@@ -30,9 +33,8 @@ export const cloudflareConnectionService = (getAppConnection: TGetAppConnectionF
   const listWorkersScripts = async (connectionId: string, actor: OrgServiceActor) => {
     const appConnection = await getAppConnection(AppConnection.Cloudflare, connectionId, actor);
     try {
-      const projects = await listCloudflareWorkersScripts(appConnection);
-
-      return projects;
+      const scripts = await listCloudflareWorkersScripts(appConnection);
+      return scripts;
     } catch (error) {
       logger.error(
         error,
@@ -42,8 +44,20 @@ export const cloudflareConnectionService = (getAppConnection: TGetAppConnectionF
     }
   };
 
+  const listZones = async (connectionId: string, actor: OrgServiceActor) => {
+    const appConnection = await getAppConnection(AppConnection.Cloudflare, connectionId, actor);
+    try {
+      const zones = await listCloudflareZones(appConnection);
+      return zones;
+    } catch (error) {
+      logger.error(error, `Failed to list Cloudflare Zones for Cloudflare connection [connectionId=${connectionId}]`);
+      return [];
+    }
+  };
+
   return {
     listPagesProjects,
-    listWorkersScripts
+    listWorkersScripts,
+    listZones
   };
 };

backend/src/services/app-connection/cloudflare/cloudflare-connection-types.ts

@@ -32,3 +32,8 @@ export type TCloudflarePagesProject = {
 export type TCloudflareWorkersScript = {
   id: string;
 };
+
+export type TCloudflareZone = {
+  id: string;
+  name: string;
+};

backend/src/services/certificate-authority/acme/acme-certificate-authority-enums.ts

@@ -1,3 +1,4 @@
 export enum AcmeDnsProvider {
-  Route53 = "route53"
+  Route53 = "route53",
+  Cloudflare = "cloudflare"
 }

backend/src/services/certificate-authority/acme/acme-certificate-authority-fns.ts

@@ -1,19 +1,17 @@
-import { ChangeResourceRecordSetsCommand, Route53Client } from "@aws-sdk/client-route-53";
 import * as x509 from "@peculiar/x509";
 import acme from "acme-client";
 
 import { TableName } from "@app/db/schemas";
-import { CustomAWSHasher } from "@app/lib/aws/hashing";
 import { crypto } from "@app/lib/crypto/cryptography";
 import { BadRequestError, CryptographyError, NotFoundError } from "@app/lib/errors";
 import { OrgServiceActor } from "@app/lib/types";
 import { blockLocalAndPrivateIpAddresses } from "@app/lib/validator";
 import { TAppConnectionDALFactory } from "@app/services/app-connection/app-connection-dal";
-import { AppConnection, AWSRegion } from "@app/services/app-connection/app-connection-enums";
+import { AppConnection } from "@app/services/app-connection/app-connection-enums";
 import { decryptAppConnection } from "@app/services/app-connection/app-connection-fns";
 import { TAppConnectionServiceFactory } from "@app/services/app-connection/app-connection-service";
-import { getAwsConnectionConfig } from "@app/services/app-connection/aws/aws-connection-fns";
-import { TAwsConnection, TAwsConnectionConfig } from "@app/services/app-connection/aws/aws-connection-types";
+import { TAwsConnection } from "@app/services/app-connection/aws/aws-connection-types";
+import { TCloudflareConnection } from "@app/services/app-connection/cloudflare/cloudflare-connection-types";
 import { TCertificateBodyDALFactory } from "@app/services/certificate/certificate-body-dal";
 import { TCertificateDALFactory } from "@app/services/certificate/certificate-dal";
 import { TCertificateSecretDALFactory } from "@app/services/certificate/certificate-secret-dal";
@@ -39,6 +37,8 @@ import {
   TCreateAcmeCertificateAuthorityDTO,
   TUpdateAcmeCertificateAuthorityDTO
 } from "./acme-certificate-authority-types";
+import { cloudflareDeleteTxtRecord, cloudflareInsertTxtRecord } from "./dns-providers/cloudflare";
+import { route53DeleteTxtRecord, route53InsertTxtRecord } from "./dns-providers/route54";
 
 type TAcmeCertificateAuthorityFnsDeps = {
   appConnectionDAL: Pick<TAppConnectionDALFactory, "findById">;
@@ -95,74 +95,6 @@ export const castDbEntryToAcmeCertificateAuthority = (
   };
 };
 
-export const route53InsertTxtRecord = async (
-  connection: TAwsConnectionConfig,
-  hostedZoneId: string,
-  domain: string,
-  value: string
-) => {
-  const config = await getAwsConnectionConfig(connection, AWSRegion.US_WEST_1); // REGION is irrelevant because Route53 is global
-  const route53Client = new Route53Client({
-    sha256: CustomAWSHasher,
-    useFipsEndpoint: crypto.isFipsModeEnabled(),
-    credentials: config.credentials!,
-    region: config.region
-  });
-
-  const command = new ChangeResourceRecordSetsCommand({
-    HostedZoneId: hostedZoneId,
-    ChangeBatch: {
-      Comment: "Set ACME challenge TXT record",
-      Changes: [
-        {
-          Action: "UPSERT",
-          ResourceRecordSet: {
-            Name: domain,
-            Type: "TXT",
-            TTL: 30,
-            ResourceRecords: [{ Value: value }]
-          }
-        }
-      ]
-    }
-  });
-
-  await route53Client.send(command);
-};
-
-export const route53DeleteTxtRecord = async (
-  connection: TAwsConnectionConfig,
-  hostedZoneId: string,
-  domain: string,
-  value: string
-) => {
-  const config = await getAwsConnectionConfig(connection, AWSRegion.US_WEST_1); // REGION is irrelevant because Route53 is global
-  const route53Client = new Route53Client({
-    credentials: config.credentials!,
-    region: config.region
-  });
-
-  const command = new ChangeResourceRecordSetsCommand({
-    HostedZoneId: hostedZoneId,
-    ChangeBatch: {
-      Comment: "Delete ACME challenge TXT record",
-      Changes: [
-        {
-          Action: "DELETE",
-          ResourceRecordSet: {
-            Name: domain,
-            Type: "TXT",
-            TTL: 30,
-            ResourceRecords: [{ Value: value }]
-          }
-        }
-      ]
-    }
-  });
-
-  await route53Client.send(command);
-};
-
 export const AcmeCertificateAuthorityFns = ({
   appConnectionDAL,
   appConnectionService,
@@ -209,6 +141,12 @@ export const AcmeCertificateAuthorityFns = ({
       });
     }
 
+    if (dnsProviderConfig.provider === AcmeDnsProvider.Cloudflare && appConnection.app !== AppConnection.Cloudflare) {
+      throw new BadRequestError({
+        message: `App connection with ID '${dnsAppConnectionId}' is not a Cloudflare connection`
+      });
+    }
+
     // validates permission to connect
     await appConnectionService.connectAppConnectionById(appConnection.app as AppConnection, dnsAppConnectionId, actor);
 
@@ -289,6 +227,15 @@ export const AcmeCertificateAuthorityFns = ({
           });
         }
 
+        if (
+          dnsProviderConfig.provider === AcmeDnsProvider.Cloudflare &&
+          appConnection.app !== AppConnection.Cloudflare
+        ) {
+          throw new BadRequestError({
+            message: `App connection with ID '${dnsAppConnectionId}' is not a Cloudflare connection`
+          });
+        }
+
         // validates permission to connect
         await appConnectionService.connectAppConnectionById(
           appConnection.app as AppConnection,
@@ -443,26 +390,56 @@ export const AcmeCertificateAuthorityFns = ({
         const recordName = `_acme-challenge.${authz.identifier.value}`; // e.g., "_acme-challenge.example.com"
         const recordValue = `"${keyAuthorization}"`; // must be double quoted
 
-        if (acmeCa.configuration.dnsProviderConfig.provider === AcmeDnsProvider.Route53) {
-          await route53InsertTxtRecord(
-            connection as TAwsConnection,
-            acmeCa.configuration.dnsProviderConfig.hostedZoneId,
-            recordName,
-            recordValue
-          );
+        switch (acmeCa.configuration.dnsProviderConfig.provider) {
+          case AcmeDnsProvider.Route53: {
+            await route53InsertTxtRecord(
+              connection as TAwsConnection,
+              acmeCa.configuration.dnsProviderConfig.hostedZoneId,
+              recordName,
+              recordValue
+            );
+            break;
+          }
+          case AcmeDnsProvider.Cloudflare: {
+            await cloudflareInsertTxtRecord(
+              connection as TCloudflareConnection,
+              acmeCa.configuration.dnsProviderConfig.hostedZoneId,
+              recordName,
+              recordValue
+            );
+            break;
+          }
+          default: {
+            throw new Error(`Unsupported DNS provider: ${acmeCa.configuration.dnsProviderConfig.provider as string}`);
+          }
         }
       },
       challengeRemoveFn: async (authz, challenge, keyAuthorization) => {
         const recordName = `_acme-challenge.${authz.identifier.value}`; // e.g., "_acme-challenge.example.com"
         const recordValue = `"${keyAuthorization}"`; // must be double quoted
 
-        if (acmeCa.configuration.dnsProviderConfig.provider === AcmeDnsProvider.Route53) {
-          await route53DeleteTxtRecord(
-            connection as TAwsConnection,
-            acmeCa.configuration.dnsProviderConfig.hostedZoneId,
-            recordName,
-            recordValue
-          );
+        switch (acmeCa.configuration.dnsProviderConfig.provider) {
+          case AcmeDnsProvider.Route53: {
+            await route53DeleteTxtRecord(
+              connection as TAwsConnection,
+              acmeCa.configuration.dnsProviderConfig.hostedZoneId,
+              recordName,
+              recordValue
+            );
+            break;
+          }
+          case AcmeDnsProvider.Cloudflare: {
+            await cloudflareDeleteTxtRecord(
+              connection as TCloudflareConnection,
+              acmeCa.configuration.dnsProviderConfig.hostedZoneId,
+              recordName,
+              recordValue
+            );
+            break;
+          }
+          default: {
+            throw new Error(`Unsupported DNS provider: ${acmeCa.configuration.dnsProviderConfig.provider as string}`);
+          }
         }
       }
     });

backend/src/services/certificate-authority/acme/dns-providers/cloudflare.ts

@@ -0,0 +1,109 @@
+import axios from "axios";
+
+import { request } from "@app/lib/config/request";
+import { TCloudflareConnectionConfig } from "@app/services/app-connection/cloudflare/cloudflare-connection-types";
+import { IntegrationUrls } from "@app/services/integration-auth/integration-list";
+
+export const cloudflareInsertTxtRecord = async (
+  connection: TCloudflareConnectionConfig,
+  hostedZoneId: string,
+  domain: string,
+  value: string
+) => {
+  const {
+    credentials: { apiToken }
+  } = connection;
+
+  try {
+    await request.post(
+      `${IntegrationUrls.CLOUDFLARE_API_URL}/client/v4/zones/${encodeURIComponent(hostedZoneId)}/dns_records`,
+      {
+        type: "TXT",
+        name: domain,
+        content: value,
+        ttl: 60,
+        proxied: false
+      },
+      {
+        headers: {
+          Authorization: `Bearer ${apiToken}`,
+          "Content-Type": "application/json",
+          Accept: "application/json"
+        }
+      }
+    );
+  } catch (error) {
+    if (axios.isAxiosError(error)) {
+      const firstErrorMessage = (
+        error.response?.data as {
+          errors?: { message: string }[];
+        }
+      )?.errors?.[0]?.message;
+      if (firstErrorMessage) {
+        throw new Error(firstErrorMessage);
+      }
+    }
+    throw error;
+  }
+};
+
+export const cloudflareDeleteTxtRecord = async (
+  connection: TCloudflareConnectionConfig,
+  hostedZoneId: string,
+  domain: string,
+  value: string
+) => {
+  const {
+    credentials: { apiToken }
+  } = connection;
+
+  try {
+    const listRecordsResponse = await request.get<{
+      result: { id: string; type: string; name: string; content: string }[];
+    }>(`${IntegrationUrls.CLOUDFLARE_API_URL}/client/v4/zones/${encodeURIComponent(hostedZoneId)}/dns_records`, {
+      headers: {
+        Authorization: `Bearer ${apiToken}`,
+        "Content-Type": "application/json",
+        Accept: "application/json"
+      },
+      params: {
+        type: "TXT",
+        name: domain,
+        content: value
+      }
+    });
+
+    const dnsRecords = listRecordsResponse.data?.result;
+
+    if (Array.isArray(dnsRecords) && dnsRecords.length > 0) {
+      const recordToDelete = dnsRecords.find(
+        (record) => record.type === "TXT" && record.name === domain && record.content === value
+      );
+
+      if (recordToDelete) {
+        await request.delete(
+          `${IntegrationUrls.CLOUDFLARE_API_URL}/client/v4/zones/${encodeURIComponent(hostedZoneId)}/dns_records/${recordToDelete.id}`,
+          {
+            headers: {
+              Authorization: `Bearer ${apiToken}`,
+              "Content-Type": "application/json",
+              Accept: "application/json"
+            }
+          }
+        );
+      }
+    }
+  } catch (error) {
+    if (axios.isAxiosError(error)) {
+      const firstErrorMessage = (
+        error.response?.data as {
+          errors?: { message: string }[];
+        }
+      )?.errors?.[0]?.message;
+      if (firstErrorMessage) {
+        throw new Error(firstErrorMessage);
+      }
+    }
+    throw error;
+  }
+};

backend/src/services/certificate-authority/acme/dns-providers/route54.ts

@@ -0,0 +1,75 @@
+import { ChangeResourceRecordSetsCommand, Route53Client } from "@aws-sdk/client-route-53";
+
+import { CustomAWSHasher } from "@app/lib/aws/hashing";
+import { crypto } from "@app/lib/crypto/cryptography";
+import { AWSRegion } from "@app/services/app-connection/app-connection-enums";
+import { getAwsConnectionConfig } from "@app/services/app-connection/aws/aws-connection-fns";
+import { TAwsConnectionConfig } from "@app/services/app-connection/aws/aws-connection-types";
+
+export const route53InsertTxtRecord = async (
+  connection: TAwsConnectionConfig,
+  hostedZoneId: string,
+  domain: string,
+  value: string
+) => {
+  const config = await getAwsConnectionConfig(connection, AWSRegion.US_WEST_1); // REGION is irrelevant because Route53 is global
+  const route53Client = new Route53Client({
+    sha256: CustomAWSHasher,
+    useFipsEndpoint: crypto.isFipsModeEnabled(),
+    credentials: config.credentials!,
+    region: config.region
+  });
+
+  const command = new ChangeResourceRecordSetsCommand({
+    HostedZoneId: hostedZoneId,
+    ChangeBatch: {
+      Comment: "Set ACME challenge TXT record",
+      Changes: [
+        {
+          Action: "UPSERT",
+          ResourceRecordSet: {
+            Name: domain,
+            Type: "TXT",
+            TTL: 30,
+            ResourceRecords: [{ Value: value }]
+          }
+        }
+      ]
+    }
+  });
+
+  await route53Client.send(command);
+};
+
+export const route53DeleteTxtRecord = async (
+  connection: TAwsConnectionConfig,
+  hostedZoneId: string,
+  domain: string,
+  value: string
+) => {
+  const config = await getAwsConnectionConfig(connection, AWSRegion.US_WEST_1); // REGION is irrelevant because Route53 is global
+  const route53Client = new Route53Client({
+    credentials: config.credentials!,
+    region: config.region
+  });
+
+  const command = new ChangeResourceRecordSetsCommand({
+    HostedZoneId: hostedZoneId,
+    ChangeBatch: {
+      Comment: "Delete ACME challenge TXT record",
+      Changes: [
+        {
+          Action: "DELETE",
+          ResourceRecordSet: {
+            Name: domain,
+            Type: "TXT",
+            TTL: 30,
+            ResourceRecords: [{ Value: value }]
+          }
+        }
+      ]
+    }
+  });
+
+  await route53Client.send(command);
+};