Merge branch 'main' into fix/docs-connections-tab-title

backend/src/services/certificate-authority/acme/acme-certificate-authority-fns.ts

@@ -1,5 +1,5 @@
 import * as x509 from "@peculiar/x509";
-import acme from "acme-client";
+import acme, { CsrBuffer } from "acme-client";
 
 import { TableName } from "@app/db/schemas";
 import { crypto } from "@app/lib/crypto/cryptography";
@@ -29,6 +29,8 @@ import { triggerAutoSyncForSubscriber } from "@app/services/pki-sync/pki-sync-ut
 import { TProjectDALFactory } from "@app/services/project/project-dal";
 import { getProjectKmsCertificateKeyId } from "@app/services/project/project-fns";
 
+import { getConfig } from "@app/lib/config/env";
+import { Knex } from "knex";
 import { TCertificateAuthorityDALFactory } from "../certificate-authority-dal";
 import { CaStatus, CaType } from "../certificate-authority-enums";
 import { keyAlgorithmToAlgCfg } from "../certificate-authority-fns";
@@ -64,6 +66,20 @@ type TAcmeCertificateAuthorityFnsDeps = {
   projectDAL: Pick<TProjectDALFactory, "findById" | "findOne" | "updateById" | "transaction">;
 };
 
+type TOrderCertificateDeps = {
+  appConnectionDAL: Pick<TAppConnectionDALFactory, "findById">;
+  certificateAuthorityDAL: Pick<TCertificateAuthorityDALFactory, "findByIdWithAssociatedCa">;
+  externalCertificateAuthorityDAL: Pick<TExternalCertificateAuthorityDALFactory, "update">;
+  certificateDAL: Pick<TCertificateDALFactory, "create" | "transaction">;
+  certificateBodyDAL: Pick<TCertificateBodyDALFactory, "create">;
+  certificateSecretDAL: Pick<TCertificateSecretDALFactory, "create">;
+  kmsService: Pick<
+    TKmsServiceFactory,
+    "encryptWithKmsKey" | "generateKmsKey" | "createCipherPairWithDataKey" | "decryptWithKmsKey"
+  >;
+  projectDAL: Pick<TProjectDALFactory, "findById" | "findOne" | "updateById" | "transaction">;
+};
+
 type DBConfigurationColumn = {
   dnsProvider: string;
   directoryUrl: string;
@@ -104,6 +120,245 @@ export const castDbEntryToAcmeCertificateAuthority = (
   };
 };
 
+export const orderCertificate = async (
+  {
+    caId,
+    subscriberId,
+    commonName,
+    altNames,
+    csr,
+    csrPrivateKey,
+    keyUsages,
+    extendedKeyUsages
+  }: {
+    caId: string;
+    subscriberId?: string;
+    commonName: string;
+    altNames?: string[];
+    csr: CsrBuffer;
+    csrPrivateKey?: string;
+    keyUsages?: CertKeyUsage[];
+    extendedKeyUsages?: CertExtendedKeyUsage[];
+  },
+  deps: TOrderCertificateDeps,
+  tx?: Knex
+) => {
+  const {
+    appConnectionDAL,
+    certificateAuthorityDAL,
+    externalCertificateAuthorityDAL,
+    certificateDAL,
+    certificateBodyDAL,
+    certificateSecretDAL,
+    kmsService,
+    projectDAL
+  } = deps;
+
+  const ca = await certificateAuthorityDAL.findByIdWithAssociatedCa(caId, tx);
+  if (!ca.externalCa || ca.externalCa.type !== CaType.ACME) {
+    throw new BadRequestError({ message: "CA is not an ACME CA" });
+  }
+
+  const acmeCa = castDbEntryToAcmeCertificateAuthority(ca);
+  if (acmeCa.status !== CaStatus.ACTIVE) {
+    throw new BadRequestError({ message: "CA is disabled" });
+  }
+
+  const certificateManagerKmsId = await getProjectKmsCertificateKeyId({
+    projectId: ca.projectId,
+    projectDAL,
+    kmsService
+  });
+
+  const kmsEncryptor = await kmsService.encryptWithKmsKey({
+    kmsId: certificateManagerKmsId
+  });
+
+  const kmsDecryptor = await kmsService.decryptWithKmsKey({
+    kmsId: certificateManagerKmsId
+  });
+
+  let accountKey: Buffer | undefined;
+  if (acmeCa.credentials) {
+    const decryptedCredentials = await kmsDecryptor({
+      cipherTextBlob: acmeCa.credentials as Buffer
+    });
+
+    const parsedCredentials = await AcmeCertificateAuthorityCredentialsSchema.parseAsync(
+      JSON.parse(decryptedCredentials.toString("utf8"))
+    );
+
+    accountKey = Buffer.from(parsedCredentials.accountKey, "base64");
+  }
+  if (!accountKey) {
+    accountKey = await acme.crypto.createPrivateRsaKey();
+    const newCredentials = {
+      accountKey: accountKey.toString("base64")
+    };
+    const { cipherTextBlob: encryptedNewCredentials } = await kmsEncryptor({
+      plainText: Buffer.from(JSON.stringify(newCredentials))
+    });
+    await externalCertificateAuthorityDAL.update(
+      {
+        caId: acmeCa.id
+      },
+      {
+        credentials: encryptedNewCredentials
+      }
+    );
+  }
+
+  await blockLocalAndPrivateIpAddresses(acmeCa.configuration.directoryUrl);
+
+  const acmeClientOptions: acme.ClientOptions = {
+    directoryUrl: acmeCa.configuration.directoryUrl,
+    accountKey
+  };
+
+  if (acmeCa.configuration.eabKid && acmeCa.configuration.eabHmacKey) {
+    acmeClientOptions.externalAccountBinding = {
+      kid: acmeCa.configuration.eabKid,
+      hmacKey: acmeCa.configuration.eabHmacKey
+    };
+  }
+
+  const acmeClient = new acme.Client(acmeClientOptions);
+
+  const appConnection = await appConnectionDAL.findById(acmeCa.configuration.dnsAppConnectionId);
+  const connection = await decryptAppConnection(appConnection, kmsService);
+
+  const pem = await acmeClient.auto({
+    csr,
+    email: acmeCa.configuration.accountEmail,
+    challengePriority: ["dns-01"],
+    // For ACME development mode, we mock the DNS challenge API calls. So, no real DNS records are created.
+    // We need to disable the challenge verification to avoid errors.
+    skipChallengeVerification: getConfig().isAcmeDevelopmentMode && getConfig().ACME_SKIP_UPSTREAM_VALIDATION,
+    termsOfServiceAgreed: true,
+
+    challengeCreateFn: async (authz, challenge, keyAuthorization) => {
+      if (challenge.type !== "dns-01") {
+        throw new Error("Unsupported challenge type");
+      }
+
+      const recordName = `_acme-challenge.${authz.identifier.value}`; // e.g., "_acme-challenge.example.com"
+      const recordValue = `"${keyAuthorization}"`; // must be double quoted
+
+      switch (acmeCa.configuration.dnsProviderConfig.provider) {
+        case AcmeDnsProvider.Route53: {
+          await route53InsertTxtRecord(
+            connection as TAwsConnection,
+            acmeCa.configuration.dnsProviderConfig.hostedZoneId,
+            recordName,
+            recordValue
+          );
+          break;
+        }
+        case AcmeDnsProvider.Cloudflare: {
+          await cloudflareInsertTxtRecord(
+            connection as TCloudflareConnection,
+            acmeCa.configuration.dnsProviderConfig.hostedZoneId,
+            recordName,
+            recordValue
+          );
+          break;
+        }
+        default: {
+          throw new Error(`Unsupported DNS provider: ${acmeCa.configuration.dnsProviderConfig.provider as string}`);
+        }
+      }
+    },
+    challengeRemoveFn: async (authz, challenge, keyAuthorization) => {
+      const recordName = `_acme-challenge.${authz.identifier.value}`; // e.g., "_acme-challenge.example.com"
+      const recordValue = `"${keyAuthorization}"`; // must be double quoted
+
+      switch (acmeCa.configuration.dnsProviderConfig.provider) {
+        case AcmeDnsProvider.Route53: {
+          await route53DeleteTxtRecord(
+            connection as TAwsConnection,
+            acmeCa.configuration.dnsProviderConfig.hostedZoneId,
+            recordName,
+            recordValue
+          );
+          break;
+        }
+        case AcmeDnsProvider.Cloudflare: {
+          await cloudflareDeleteTxtRecord(
+            connection as TCloudflareConnection,
+            acmeCa.configuration.dnsProviderConfig.hostedZoneId,
+            recordName,
+            recordValue
+          );
+          break;
+        }
+        default: {
+          throw new Error(`Unsupported DNS provider: ${acmeCa.configuration.dnsProviderConfig.provider as string}`);
+        }
+      }
+    }
+  });
+
+  const [leafCert, parentCert] = acme.crypto.splitPemChain(pem);
+  const certObj = new x509.X509Certificate(leafCert);
+
+  const { cipherTextBlob: encryptedCertificate } = await kmsEncryptor({
+    plainText: Buffer.from(new Uint8Array(certObj.rawData))
+  });
+
+  const certificateChainPem = parentCert.trim();
+
+  const { cipherTextBlob: encryptedCertificateChain } = await kmsEncryptor({
+    plainText: Buffer.from(certificateChainPem)
+  });
+
+  const { cipherTextBlob: encryptedPrivateKey } = csrPrivateKey
+    ? await kmsEncryptor({
+        plainText: Buffer.from(csrPrivateKey)
+      })
+    : { cipherTextBlob: undefined };
+
+  return (tx || certificateDAL).transaction(async (innerTx: Knex) => {
+    const cert = await certificateDAL.create(
+      {
+        caId: ca.id,
+        pkiSubscriberId: subscriberId,
+        status: CertStatus.ACTIVE,
+        friendlyName: commonName,
+        commonName,
+        altNames: altNames?.join(","),
+        serialNumber: certObj.serialNumber,
+        notBefore: certObj.notBefore,
+        notAfter: certObj.notAfter,
+        keyUsages,
+        extendedKeyUsages,
+        projectId: ca.projectId
+      },
+      innerTx
+    );
+
+    await certificateBodyDAL.create(
+      {
+        certId: cert.id,
+        encryptedCertificate,
+        encryptedCertificateChain
+      },
+      innerTx
+    );
+
+    if (encryptedPrivateKey !== undefined) {
+      await certificateSecretDAL.create(
+        {
+          certId: cert.id,
+          encryptedPrivateKey
+        },
+        innerTx
+      );
+    }
+
+    return cert;
+  });
+};
+
 export const AcmeCertificateAuthorityFns = ({
   appConnectionDAL,
   appConnectionService,
@@ -322,77 +577,6 @@ export const AcmeCertificateAuthorityFns = ({
     if (!subscriber.caId) {
       throw new BadRequestError({ message: "Subscriber does not have a CA" });
     }
-
-    const ca = await certificateAuthorityDAL.findByIdWithAssociatedCa(subscriber.caId);
-    if (!ca.externalCa || ca.externalCa.type !== CaType.ACME) {
-      throw new BadRequestError({ message: "CA is not an ACME CA" });
-    }
-
-    const acmeCa = castDbEntryToAcmeCertificateAuthority(ca);
-    if (acmeCa.status !== CaStatus.ACTIVE) {
-      throw new BadRequestError({ message: "CA is disabled" });
-    }
-
-    const certificateManagerKmsId = await getProjectKmsCertificateKeyId({
-      projectId: ca.projectId,
-      projectDAL,
-      kmsService
-    });
-
-    const kmsEncryptor = await kmsService.encryptWithKmsKey({
-      kmsId: certificateManagerKmsId
-    });
-
-    const kmsDecryptor = await kmsService.decryptWithKmsKey({
-      kmsId: certificateManagerKmsId
-    });
-
-    let accountKey: Buffer | undefined;
-    if (acmeCa.credentials) {
-      const decryptedCredentials = await kmsDecryptor({
-        cipherTextBlob: acmeCa.credentials as Buffer
-      });
-
-      const parsedCredentials = await AcmeCertificateAuthorityCredentialsSchema.parseAsync(
-        JSON.parse(decryptedCredentials.toString("utf8"))
-      );
-
-      accountKey = Buffer.from(parsedCredentials.accountKey, "base64");
-    }
-    if (!accountKey) {
-      accountKey = await acme.crypto.createPrivateRsaKey();
-      const newCredentials = {
-        accountKey: accountKey.toString("base64")
-      };
-      const { cipherTextBlob: encryptedNewCredentials } = await kmsEncryptor({
-        plainText: Buffer.from(JSON.stringify(newCredentials))
-      });
-      await externalCertificateAuthorityDAL.update(
-        {
-          caId: acmeCa.id
-        },
-        {
-          credentials: encryptedNewCredentials
-        }
-      );
-    }
-
-    await blockLocalAndPrivateIpAddresses(acmeCa.configuration.directoryUrl);
-
-    const acmeClientOptions: acme.ClientOptions = {
-      directoryUrl: acmeCa.configuration.directoryUrl,
-      accountKey
-    };
-
-    if (acmeCa.configuration.eabKid && acmeCa.configuration.eabHmacKey) {
-      acmeClientOptions.externalAccountBinding = {
-        kid: acmeCa.configuration.eabKid,
-        hmacKey: acmeCa.configuration.eabHmacKey
-      };
-    }
-
-    const acmeClient = new acme.Client(acmeClientOptions);
-
     const alg = keyAlgorithmToAlgCfg(CertKeyAlgorithm.RSA_2048);
 
     const leafKeys = await crypto.nativeCrypto.subtle.generateKey(alg, true, ["sign", "verify"]);
@@ -407,131 +591,28 @@ export const AcmeCertificateAuthorityFns = ({
       skLeaf
     );
 
-    const appConnection = await appConnectionDAL.findById(acmeCa.configuration.dnsAppConnectionId);
-    const connection = await decryptAppConnection(appConnection, kmsService);
-
-    const pem = await acmeClient.auto({
-      csr: certificateCsr,
-      email: acmeCa.configuration.accountEmail,
-      challengePriority: ["dns-01"],
-      termsOfServiceAgreed: true,
-
-      challengeCreateFn: async (authz, challenge, keyAuthorization) => {
-        if (challenge.type !== "dns-01") {
-          throw new Error("Unsupported challenge type");
-        }
-
-        const recordName = `_acme-challenge.${authz.identifier.value}`; // e.g., "_acme-challenge.example.com"
-        const recordValue = `"${keyAuthorization}"`; // must be double quoted
-
-        switch (acmeCa.configuration.dnsProviderConfig.provider) {
-          case AcmeDnsProvider.Route53: {
-            await route53InsertTxtRecord(
-              connection as TAwsConnection,
-              acmeCa.configuration.dnsProviderConfig.hostedZoneId,
-              recordName,
-              recordValue
-            );
-            break;
-          }
-          case AcmeDnsProvider.Cloudflare: {
-            await cloudflareInsertTxtRecord(
-              connection as TCloudflareConnection,
-              acmeCa.configuration.dnsProviderConfig.hostedZoneId,
-              recordName,
-              recordValue
-            );
-            break;
-          }
-          default: {
-            throw new Error(`Unsupported DNS provider: ${acmeCa.configuration.dnsProviderConfig.provider as string}`);
-          }
-        }
+    await orderCertificate(
+      {
+        caId: subscriber.caId,
+        subscriberId: subscriber.id,
+        commonName: subscriber.commonName,
+        altNames: subscriber.subjectAlternativeNames,
+        csr: certificateCsr,
+        csrPrivateKey: skLeaf,
+        keyUsages: subscriber.keyUsages as CertKeyUsage[],
+        extendedKeyUsages: subscriber.extendedKeyUsages as CertExtendedKeyUsage[]
       },
-      challengeRemoveFn: async (authz, challenge, keyAuthorization) => {
-        const recordName = `_acme-challenge.${authz.identifier.value}`; // e.g., "_acme-challenge.example.com"
-        const recordValue = `"${keyAuthorization}"`; // must be double quoted
-
-        switch (acmeCa.configuration.dnsProviderConfig.provider) {
-          case AcmeDnsProvider.Route53: {
-            await route53DeleteTxtRecord(
-              connection as TAwsConnection,
-              acmeCa.configuration.dnsProviderConfig.hostedZoneId,
-              recordName,
-              recordValue
-            );
-            break;
-          }
-          case AcmeDnsProvider.Cloudflare: {
-            await cloudflareDeleteTxtRecord(
-              connection as TCloudflareConnection,
-              acmeCa.configuration.dnsProviderConfig.hostedZoneId,
-              recordName,
-              recordValue
-            );
-            break;
-          }
-          default: {
-            throw new Error(`Unsupported DNS provider: ${acmeCa.configuration.dnsProviderConfig.provider as string}`);
-          }
-        }
+      {
+        appConnectionDAL,
+        certificateAuthorityDAL,
+        externalCertificateAuthorityDAL,
+        certificateDAL,
+        certificateBodyDAL,
+        certificateSecretDAL,
+        kmsService,
+        projectDAL
       }
-    });
-
-    const [leafCert, parentCert] = acme.crypto.splitPemChain(pem);
-    const certObj = new x509.X509Certificate(leafCert);
-
-    const { cipherTextBlob: encryptedCertificate } = await kmsEncryptor({
-      plainText: Buffer.from(new Uint8Array(certObj.rawData))
-    });
-
-    const certificateChainPem = parentCert.trim();
-
-    const { cipherTextBlob: encryptedCertificateChain } = await kmsEncryptor({
-      plainText: Buffer.from(certificateChainPem)
-    });
-
-    const { cipherTextBlob: encryptedPrivateKey } = await kmsEncryptor({
-      plainText: Buffer.from(skLeaf)
-    });
-
-    await certificateDAL.transaction(async (tx) => {
-      const cert = await certificateDAL.create(
-        {
-          caId: ca.id,
-          pkiSubscriberId: subscriber.id,
-          status: CertStatus.ACTIVE,
-          friendlyName: subscriber.commonName,
-          commonName: subscriber.commonName,
-          altNames: subscriber.subjectAlternativeNames.join(","),
-          serialNumber: certObj.serialNumber,
-          notBefore: certObj.notBefore,
-          notAfter: certObj.notAfter,
-          keyUsages: subscriber.keyUsages as CertKeyUsage[],
-          extendedKeyUsages: subscriber.extendedKeyUsages as CertExtendedKeyUsage[],
-          projectId: ca.projectId
-        },
-        tx
-      );
-
-      await certificateBodyDAL.create(
-        {
-          certId: cert.id,
-          encryptedCertificate,
-          encryptedCertificateChain
-        },
-        tx
-      );
-
-      await certificateSecretDAL.create(
-        {
-          certId: cert.id,
-          encryptedPrivateKey
-        },
-        tx
-      );
-    });
-
+    );
     await triggerAutoSyncForSubscriber(subscriber.id, { pkiSyncDAL, pkiSyncQueue });
   };
 

backend/src/services/certificate-profile/certificate-profile-dal.ts

@@ -168,15 +168,12 @@ export const certificateProfileDALFactory = (db: TDbClient) => {
           } as TCertificateProfileWithConfigs["acmeConfig"])
         : undefined;
 
-      const certificateAuthority =
-        result.caId && result.caProjectId && result.caStatus && result.caName
-          ? ({
-              id: result.caId,
-              projectId: result.caProjectId,
-              status: result.caStatus,
-              name: result.caName
-            } as TCertificateProfileWithConfigs["certificateAuthority"])
-          : undefined;
+      const certificateAuthority = {
+        id: result.caId,
+        projectId: result.caProjectId,
+        status: result.caStatus,
+        name: result.caName
+      } as TCertificateProfileWithConfigs["certificateAuthority"];
 
       const certificateTemplate =
         result.templateId && result.templateProjectId && result.templateName

backend/src/services/role/role-service.ts

@@ -6,6 +6,7 @@ import { TPermissionServiceFactory } from "@app/ee/services/permission/permissio
 import { BadRequestError, NotFoundError } from "@app/lib/errors";
 import { validateHandlebarTemplate } from "@app/lib/template/validate-handlebars";
 import { UnpackedPermissionSchema, unpackPermissions } from "@app/server/routes/sanitizedSchema/permission";
+import { TMembershipRoleDALFactory } from "@app/services/membership/membership-role-dal";
 
 import { ActorType } from "../auth/auth-type";
 import { TExternalGroupOrgRoleMappingDALFactory } from "../external-group-org-role-mapping/external-group-org-role-mapping-dal";
@@ -33,6 +34,7 @@ type TRoleServiceFactoryDep = {
   permissionService: Pick<TPermissionServiceFactory, "getProjectPermission" | "getOrgPermission">;
   projectDAL: Pick<TProjectDALFactory, "findById">;
   externalGroupOrgRoleMappingDAL: Pick<TExternalGroupOrgRoleMappingDALFactory, "findOne">;
+  membershipRoleDAL: Pick<TMembershipRoleDALFactory, "find">;
 };
 
 export type TRoleServiceFactory = ReturnType<typeof roleServiceFactory>;
@@ -43,7 +45,8 @@ export const roleServiceFactory = ({
   projectDAL,
   identityDAL,
   userDAL,
-  externalGroupOrgRoleMappingDAL
+  externalGroupOrgRoleMappingDAL,
+  membershipRoleDAL
 }: TRoleServiceFactoryDep) => {
   const orgRoleFactory = newOrgRoleFactory({
     permissionService,
@@ -137,6 +140,23 @@ export const roleServiceFactory = ({
     });
     if (!existingRole) throw new NotFoundError({ message: `Role with ${dto.selector.id} not found` });
 
+    const [roleUsageData] = await membershipRoleDAL.find(
+      {
+        customRoleId: dto.selector.id
+      },
+      { count: true }
+    );
+
+    if (roleUsageData) {
+      const count = Number.parseInt(roleUsageData.count, 10);
+      if (count > 0) {
+        const plural = count > 1 ? "s" : "";
+        throw new BadRequestError({
+          message: `Role is assigned to ${count} identity membership${plural}. Re-assign membership role${plural} to delete this role.`
+        });
+      }
+    }
+
     const [role] = await roleDAL.delete({
       id: existingRole.id,
       [scope.key]: scope.value