Issue cert

backend/src/services/auth/auth-type.ts

@@ -41,6 +41,7 @@ export enum ActorType { // would extend to AWS, Azure, ...
   IDENTITY = "identity",
   Machine = "machine",
   SCIM_CLIENT = "scimClient",
+  ACME_ACCOUNT = "acmeAccount",
   UNKNOWN_USER = "unknownUser"
 }
 

backend/src/services/certificate-profile/certificate-profile-dal.ts

@@ -65,6 +65,23 @@ export const certificateProfileDALFactory = (db: TDbClient) => {
     }
   };
 
+  const findByIdWithOwnerOrgId = async (
+    id: string,
+    tx?: Knex
+  ): Promise<(TCertificateProfile & { ownerOrgId: string }) | undefined> => {
+    try {
+      const certificateProfile = (await (tx || db)(TableName.PkiCertificateProfile)
+        .join(TableName.Project, `${TableName.PkiCertificateProfile}.projectId`, `${TableName.Project}.id`)
+        .select(selectAllTableCols(TableName.PkiCertificateProfile))
+        .select(db.ref("orgId").withSchema(TableName.Project).as("ownerOrgId"))
+        .where({ id })
+        .first()) as (TCertificateProfile & { ownerOrgId: string }) | undefined;
+      return certificateProfile;
+    } catch (error) {
+      throw new DatabaseError({ error, name: "Find certificate profile by id with owner org id" });
+    }
+  };
+
   const findByIdWithConfigs = async (id: string, tx?: Knex): Promise<TCertificateProfileWithConfigs | undefined> => {
     try {
       const query = (tx || db)(TableName.PkiCertificateProfile)
@@ -444,6 +461,7 @@ export const certificateProfileDALFactory = (db: TDbClient) => {
     updateById,
     deleteById,
     findById,
+    findByIdWithOwnerOrgId,
     findByIdWithConfigs,
     findBySlugAndProjectId,
     findByProjectId,

backend/src/services/certificate-v3/certificate-v3-service.test.ts

@@ -697,6 +697,7 @@ describe("CertificateV3Service", () => {
         profileId,
         csr: mockCSR,
         validity: mockValidity,
+        enrollmentType: EnrollmentType.API,
         ...mockActor
       });
 
@@ -731,6 +732,7 @@ describe("CertificateV3Service", () => {
           profileId,
           csr: mockCSR,
           validity: mockValidity,
+          enrollmentType: EnrollmentType.API,
           ...mockActor
         })
       ).rejects.toThrow(ForbiddenRequestError);
@@ -740,6 +742,7 @@ describe("CertificateV3Service", () => {
           profileId,
           csr: mockCSR,
           validity: mockValidity,
+          enrollmentType: EnrollmentType.API,
           ...mockActor
         })
       ).rejects.toThrow("Profile is not configured for api enrollment");

backend/src/services/certificate-v3/certificate-v3-service.ts

@@ -107,6 +107,13 @@ const validateProfileAndPermissions = async (
     });
   }
 
+  // XXX: NOT SURE IF THIS IS SECURE TO BY PASS THE PERMISSION CHECK FOR ACME ACCOUNTS
+  //      may need to consider this carefully
+  // TODO: check actor/profile ownership as well
+  if (actor === ActorType.ACME_ACCOUNT && requiredEnrollmentType === EnrollmentType.ACME) {
+    return profile;
+  }
+
   const { permission } = await permissionService.getProjectPermission({
     actor,
     actorId,
@@ -484,7 +491,8 @@ export const certificateV3ServiceFactory = ({
     actor,
     actorId,
     actorAuthMethod,
-    actorOrgId
+    actorOrgId,
+    enrollmentType
   }: TSignCertificateFromProfileDTO): Promise<Omit<TCertificateFromProfileResponse, "privateKey">> => {
     const profile = await validateProfileAndPermissions(
       profileId,
@@ -494,7 +502,7 @@ export const certificateV3ServiceFactory = ({
       actorOrgId,
       certificateProfileDAL,
       permissionService,
-      EnrollmentType.API
+      enrollmentType
     );
 
     const ca = await certificateAuthorityDAL.findByIdWithAssociatedCa(profile.caId);

backend/src/services/certificate-v3/certificate-v3-types.ts

@@ -1,11 +1,12 @@
 import { TProjectPermission } from "@app/lib/types";
 
-import { ACMESANType, CertificateOrderStatus } from "../certificate/certificate-types";
 import {
   CertExtendedKeyUsageType,
   CertKeyUsageType,
   CertSubjectAlternativeNameType
 } from "../certificate-common/certificate-constants";
+import { EnrollmentType } from "../certificate-profile/certificate-profile-types";
+import { ACMESANType, CertificateOrderStatus } from "../certificate/certificate-types";
 
 export type TIssueCertificateFromProfileDTO = {
   profileId: string;
@@ -35,6 +36,7 @@ export type TSignCertificateFromProfileDTO = {
   };
   notBefore?: Date;
   notAfter?: Date;
+  enrollmentType: EnrollmentType;
 } & Omit<TProjectPermission, "projectId">;
 
 export type TOrderCertificateFromProfileDTO = {