Make PR review adjustments, ssh ca public key endpoint, ssh cert template status

backend/src/ee/services/ssh/ssh-certificate-authority-fns.ts

@@ -53,7 +53,9 @@ export const createSshKeyPair = (keyAlgorithm: CertKeyAlgorithm, comment: string
       keyBits = "384";
       break;
     default:
-      throw new Error("Failed to produce SSH CA key pair generation command due to unrecognized key algorithm");
+      throw new BadRequestError({
+        message: "Failed to produce SSH CA key pair generation command due to unrecognized key algorithm"
+      });
   }
 
   execSync(`ssh-keygen -t ${keyType} -b ${keyBits} -f ${privateKeyFile} -N '' -C "${comment}"`);
@@ -200,7 +202,7 @@ export const validateSshCertificatePrincipals = (
  * @param ttl - The TTL to validate
  * @returns The TTL (in seconds) to use for issuing the SSH certificate
  */
-export const validateSshCertificateTtl = (template: TSshCertificateTemplates, ttl: string | undefined) => {
+export const validateSshCertificateTtl = (template: TSshCertificateTemplates, ttl?: string) => {
   if (!ttl) {
     // use default template ttl
     return ms(template.ttl) / 1000;
@@ -249,6 +251,8 @@ export const createSshCert = ({ caPrivateKey, userPublicKey, keyId, principals,
 
   const command = `ssh-keygen ${certOptions}`;
 
+  console.log("executing command", command);
+
   // Execute the signing process
   execSync(command);
 

backend/src/ee/services/ssh/ssh-certificate-authority-service.ts

@@ -9,6 +9,7 @@ import { TSshCertificateTemplateDALFactory } from "@app/ee/services/ssh-certific
 import { BadRequestError, NotFoundError } from "@app/lib/errors";
 import { TKmsServiceFactory } from "@app/services/kms/kms-service";
 
+import { SshCertTemplateStatus } from "../ssh-certificate-template/ssh-certificate-template-types";
 import {
   createSshCert,
   createSshKeyPair,
@@ -23,6 +24,7 @@ import {
   TDeleteSshCaDTO,
   TGetSshCaCertificateTemplatesDTO,
   TGetSshCaDTO,
+  TGetSshCaPublicKeyDTO,
   TIssueSshCredsDTO,
   TSignSshKeyDTO,
   TUpdateSshCaDTO
@@ -147,6 +149,30 @@ export const sshCertificateAuthorityServiceFactory = ({
     return { ...ca, publicKey };
   };
 
+  /**
+   * Return public key of SSH CA with id [caId]
+   */
+  const getSshCaPublicKey = async ({ caId }: TGetSshCaPublicKeyDTO) => {
+    const ca = await sshCertificateAuthorityDAL.findById(caId);
+    if (!ca) throw new NotFoundError({ message: `SSH CA with ID '${caId}' not found` });
+
+    const sshCaSecret = await sshCertificateAuthoritySecretDAL.findOne({ sshCaId: ca.id });
+
+    // decrypt secret
+    const orgKmsKeyId = await kmsService.getOrgKmsKeyId(ca.orgId);
+    const kmsDecryptor = await kmsService.decryptWithKmsKey({
+      kmsId: orgKmsKeyId
+    });
+
+    const decryptedCaPrivateKey = await kmsDecryptor({
+      cipherTextBlob: sshCaSecret.encryptedPrivateKey
+    });
+
+    const publicKey = getSshPublicKey(decryptedCaPrivateKey.toString("utf-8"));
+
+    return publicKey;
+  };
+
   /**
    * Update SSH CA with id [caId]
    * Note: Used to enable/disable CA
@@ -259,6 +285,12 @@ export const sshCertificateAuthorityServiceFactory = ({
       });
     }
 
+    if (sshCertificateTemplate.status === SshCertTemplateStatus.DISABLED) {
+      throw new BadRequestError({
+        message: "SSH certificate template is disabled"
+      });
+    }
+
     // validate if the requested [certType] is allowed under the template configuration
     validateSshCertificateType(sshCertificateTemplate, certType);
 
@@ -359,6 +391,12 @@ export const sshCertificateAuthorityServiceFactory = ({
       });
     }
 
+    if (sshCertificateTemplate.status === SshCertTemplateStatus.DISABLED) {
+      throw new BadRequestError({
+        message: "SSH certificate template is disabled"
+      });
+    }
+
     // validate if the requested [certType] is allowed under the template configuration
     validateSshCertificateType(sshCertificateTemplate, certType);
 
@@ -445,6 +483,7 @@ export const sshCertificateAuthorityServiceFactory = ({
     signSshKey,
     createSshCa,
     getSshCaById,
+    getSshCaPublicKey,
     updateSshCaById,
     deleteSshCaById,
     getSshCaCertificateTemplates

backend/src/ee/services/ssh/ssh-certificate-authority-types.ts

@@ -20,6 +20,10 @@ export type TGetSshCaDTO = {
   caId: string;
 } & Omit<TOrgPermission, "orgId">;
 
+export type TGetSshCaPublicKeyDTO = {
+  caId: string;
+};
+
 export type TUpdateSshCaDTO = {
   caId: string;
   friendlyName?: string;