awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-09-22 13:39:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

misc: updated est configuration to be binded to certificate template

Browse Source
This commit is contained in:
Sheen Capadngan
2024-08-19 19:26:20 +08:00
parent 3a4f8c2e54
commit 692bdc060c
26 changed files with 508 additions and 493 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
backend/src/@types/knex.d.ts vendored
View File

@@ -53,6 +53,9 @@ import {
TCertificateSecretsUpdate,
TCertificatesInsert,
TCertificatesUpdate,
TCertificateTemplateEstConfigs,
TCertificateTemplateEstConfigsInsert,
TCertificateTemplateEstConfigsUpdate,
TCertificateTemplates,
TCertificateTemplatesInsert,
TCertificateTemplatesUpdate,
@@ -321,11 +324,6 @@ import {
TWebhooksInsert,
TWebhooksUpdate
} from "@app/db/schemas";
import {
TCertificateAuthorityEstConfigs,
TCertificateAuthorityEstConfigsInsert,
TCertificateAuthorityEstConfigsUpdate
} from "@app/db/schemas/certificate-authority-est-configs";
import {
TSecretV2TagJunction,
TSecretV2TagJunctionInsert,
@@ -377,6 +375,11 @@ declare module "knex/types/tables" {
TCertificateTemplatesInsert,
TCertificateTemplatesUpdate
>;
[TableName.CertificateTemplateEstConfig]: KnexOriginal.CompositeTableType<
TCertificateTemplateEstConfigs,
TCertificateTemplateEstConfigsInsert,
TCertificateTemplateEstConfigsUpdate
>;
[TableName.CertificateBody]: KnexOriginal.CompositeTableType<
TCertificateBodies,
TCertificateBodiesInsert,
@@ -387,11 +390,6 @@ declare module "knex/types/tables" {
TCertificateSecretsInsert,
TCertificateSecretsUpdate
>;
[TableName.CertificateAuthorityEstConfig]: KnexOriginal.CompositeTableType<
TCertificateAuthorityEstConfigs,
TCertificateAuthorityEstConfigsInsert,
TCertificateAuthorityEstConfigsUpdate
>;
[TableName.PkiAlert]: KnexOriginal.CompositeTableType<TPkiAlerts, TPkiAlertsInsert, TPkiAlertsUpdate>;
[TableName.PkiCollection]: KnexOriginal.CompositeTableType<
TPkiCollections,

14
backend/src/db/migrations/20240813141341_certificate-authority-est-configuration.ts → backend/src/db/migrations/20240819092916_certificate-template-est-configuration.ts
View File

@@ -4,23 +4,23 @@ import { TableName } from "../schemas";
import { createOnUpdateTrigger, dropOnUpdateTrigger } from "../utils";
export async function up(knex: Knex): Promise<void> {
const hasEstConfigTable = await knex.schema.hasTable(TableName.CertificateAuthorityEstConfig);
const hasEstConfigTable = await knex.schema.hasTable(TableName.CertificateTemplateEstConfig);
if (!hasEstConfigTable) {
await knex.schema.createTable(TableName.CertificateAuthorityEstConfig, (tb) => {
await knex.schema.createTable(TableName.CertificateTemplateEstConfig, (tb) => {
tb.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
tb.uuid("caId").notNullable().unique();
tb.foreign("caId").references("id").inTable(TableName.CertificateAuthority).onDelete("CASCADE");
tb.uuid("certificateTemplateId").notNullable().unique();
tb.foreign("certificateTemplateId").references("id").inTable(TableName.CertificateTemplate).onDelete("CASCADE");
tb.binary("encryptedCaChain").notNullable();
tb.string("hashedPassphrase").notNullable();
tb.boolean("isEnabled");
tb.timestamps(true, true, true);
});
await createOnUpdateTrigger(knex, TableName.CertificateAuthorityEstConfig);
await createOnUpdateTrigger(knex, TableName.CertificateTemplateEstConfig);
}
}
export async function down(knex: Knex): Promise<void> {
await knex.schema.dropTableIfExists(TableName.CertificateAuthorityEstConfig);
await dropOnUpdateTrigger(knex, TableName.CertificateAuthorityEstConfig);
await knex.schema.dropTableIfExists(TableName.CertificateTemplateEstConfig);
await dropOnUpdateTrigger(knex, TableName.CertificateTemplateEstConfig);
}

14
backend/src/db/schemas/certificate-authority-est-configs.ts → backend/src/db/schemas/certificate-template-est-configs.ts
View File

@@ -9,9 +9,9 @@ import { zodBuffer } from "@app/lib/zod";
import { TImmutableDBKeys } from "./models";
export const CertificateAuthorityEstConfigsSchema = z.object({
export const CertificateTemplateEstConfigsSchema = z.object({
id: z.string().uuid(),
caId: z.string().uuid(),
certificateTemplateId: z.string().uuid(),
encryptedCaChain: zodBuffer,
hashedPassphrase: z.string(),
isEnabled: z.boolean().nullable().optional(),
@@ -19,11 +19,11 @@ export const CertificateAuthorityEstConfigsSchema = z.object({
updatedAt: z.date()
});
export type TCertificateAuthorityEstConfigs = z.infer<typeof CertificateAuthorityEstConfigsSchema>;
export type TCertificateAuthorityEstConfigsInsert = Omit<
z.input<typeof CertificateAuthorityEstConfigsSchema>,
export type TCertificateTemplateEstConfigs = z.infer<typeof CertificateTemplateEstConfigsSchema>;
export type TCertificateTemplateEstConfigsInsert = Omit<
z.input<typeof CertificateTemplateEstConfigsSchema>,
TImmutableDBKeys
>;
export type TCertificateAuthorityEstConfigsUpdate = Partial<
Omit<z.input<typeof CertificateAuthorityEstConfigsSchema>, TImmutableDBKeys>
export type TCertificateTemplateEstConfigsUpdate = Partial<
Omit<z.input<typeof CertificateTemplateEstConfigsSchema>, TImmutableDBKeys>
>;

1
backend/src/db/schemas/index.ts
View File

@@ -14,6 +14,7 @@ export * from "./certificate-authority-crl";
export * from "./certificate-authority-secret";
export * from "./certificate-bodies";
export * from "./certificate-secrets";
export * from "./certificate-template-est-configs";
export * from "./certificate-templates";
export * from "./certificates";
export * from "./dynamic-secret-leases";

2
backend/src/db/schemas/models.ts
View File

@@ -3,7 +3,7 @@ import { z } from "zod";
export enum TableName {
Users = "users",
CertificateAuthority = "certificate_authorities",
CertificateAuthorityEstConfig = "certificate_authority_est_configs",
CertificateTemplateEstConfig = "certificate_template_est_configs",
CertificateAuthorityCert = "certificate_authority_certs",
CertificateAuthoritySecret = "certificate_authority_secret",
CertificateAuthorityCrl = "certificate_authority_crl",

12
backend/src/server/routes/est/certificate-est-router.ts
View File

@@ -39,13 +39,13 @@ export const registerCertificateEstRouter = async (server: FastifyZodProvider) =
}
const urlFragments = req.url.split("/");
const certificateAuthorityId = urlFragments.slice(-2)[0];
const caEstConfig = await server.services.certificateAuthority.getCaEstConfiguration({
const certificateTemplateId = urlFragments.slice(-2)[0];
const estConfig = await server.services.certificateTemplate.getEstConfiguration({
isInternal: true,
caId: certificateAuthorityId
certificateTemplateId
});
if (!caEstConfig.isEnabled) {
if (!estConfig.isEnabled) {
throw new BadRequestError({
message: "EST enrollment is disabled"
});
@@ -68,7 +68,7 @@ export const registerCertificateEstRouter = async (server: FastifyZodProvider) =
.trim();
// validate SSL client cert against configured CA
const chainCerts = caEstConfig.caChain
const chainCerts = estConfig.caChain
.match(/-----BEGIN CERTIFICATE-----[\s\S]+?-----END CERTIFICATE-----/g)
?.map((cert) => {
const processedBody = cert
@@ -122,7 +122,7 @@ export const registerCertificateEstRouter = async (server: FastifyZodProvider) =
});
}
const isPasswordValid = await bcrypt.compare(password, caEstConfig.hashedPassphrase);
const isPasswordValid = await bcrypt.compare(password, estConfig.hashedPassphrase);
if (!isPasswordValid) {
throw new UnauthorizedError({
message: "Invalid credentials"

12
backend/src/server/routes/index.ts
View File

@@ -86,11 +86,11 @@ import { certificateDALFactory } from "@app/services/certificate/certificate-dal
import { certificateServiceFactory } from "@app/services/certificate/certificate-service";
import { certificateAuthorityCertDALFactory } from "@app/services/certificate-authority/certificate-authority-cert-dal";
import { certificateAuthorityDALFactory } from "@app/services/certificate-authority/certificate-authority-dal";
import { certificateAuthorityEstConfigDALFactory } from "@app/services/certificate-authority/certificate-authority-est-config-dal";
import { certificateAuthorityQueueFactory } from "@app/services/certificate-authority/certificate-authority-queue";
import { certificateAuthoritySecretDALFactory } from "@app/services/certificate-authority/certificate-authority-secret-dal";
import { certificateAuthorityServiceFactory } from "@app/services/certificate-authority/certificate-authority-service";
import { certificateTemplateDALFactory } from "@app/services/certificate-template/certificate-template-dal";
import { certificateTemplateEstConfigDALFactory } from "@app/services/certificate-template/certificate-template-est-config-dal";
import { certificateTemplateServiceFactory } from "@app/services/certificate-template/certificate-template-service";
import { groupProjectDALFactory } from "@app/services/group-project/group-project-dal";
import { groupProjectMembershipRoleDALFactory } from "@app/services/group-project/group-project-membership-role-dal";
@@ -591,8 +591,8 @@ export const registerRoutes = async (
const certificateAuthorityCertDAL = certificateAuthorityCertDALFactory(db);
const certificateAuthoritySecretDAL = certificateAuthoritySecretDALFactory(db);
const certificateAuthorityCrlDAL = certificateAuthorityCrlDALFactory(db);
const certificateAuthorityEstConfigDAL = certificateAuthorityEstConfigDALFactory(db);
const certificateTemplateDAL = certificateTemplateDALFactory(db);
const certificateTemplateEstConfigDAL = certificateTemplateEstConfigDALFactory(db);
const certificateDAL = certificateDALFactory(db);
const certificateBodyDAL = certificateBodyDALFactory(db);
@@ -636,8 +636,7 @@ export const registerRoutes = async (
pkiCollectionItemDAL,
projectDAL,
kmsService,
permissionService,
certificateAuthorityEstConfigDAL
permissionService
});
const certificateAuthorityCrlService = certificateAuthorityCrlServiceFactory({
@@ -651,8 +650,11 @@ export const registerRoutes = async (
const certificateTemplateService = certificateTemplateServiceFactory({
certificateTemplateDAL,
certificateTemplateEstConfigDAL,
certificateAuthorityDAL,
permissionService
permissionService,
kmsService,
projectDAL
});
const pkiAlertService = pkiAlertServiceFactory({

126
backend/src/server/routes/v1/certificate-authority-router.ts
View File

@@ -2,7 +2,6 @@ import ms from "ms";
import { z } from "zod";
import { CertificateAuthoritiesSchema } from "@app/db/schemas";
import { CertificateAuthorityEstConfigsSchema } from "@app/db/schemas/certificate-authority-est-configs";
import { EventType } from "@app/ee/services/audit-log/audit-log-types";
import { CERTIFICATE_AUTHORITIES } from "@app/lib/api-docs";
import { readLimit, writeLimit } from "@app/server/config/rateLimiter";
@@ -700,129 +699,4 @@ export const registerCaRouter = async (server: FastifyZodProvider) => {
};
}
});
server.route({
method: "POST",
url: "/:caId/est-config",
config: {
rateLimit: writeLimit
},
onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
schema: {
description: "Create CA EST configuration",
params: z.object({
caId: z.string().trim()
}),
body: z.object({
caChain: z.string().trim().min(1),
passphrase: z.string().min(1),
isEnabled: z.boolean().default(true)
}),
response: {
200: z.object({
caEstConfig: CertificateAuthorityEstConfigsSchema.pick({
caId: true,
isEnabled: true
})
})
}
},
handler: async (req) => {
const caEstConfig = await server.services.certificateAuthority.createCaEstConfiguration({
caId: req.params.caId,
actor: req.permission.type,
actorId: req.permission.id,
actorAuthMethod: req.permission.authMethod,
actorOrgId: req.permission.orgId,
...req.body
});
return {
caEstConfig
};
}
});
server.route({
method: "PATCH",
url: "/:caId/est-config",
config: {
rateLimit: writeLimit
},
onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
schema: {
description: "Update CA EST configuration",
params: z.object({
caId: z.string().trim()
}),
body: z.object({
caChain: z.string().trim().min(1).optional(),
passphrase: z.string().min(1).optional(),
isEnabled: z.boolean().optional()
}),
response: {
200: z.object({
caEstConfig: CertificateAuthorityEstConfigsSchema.pick({
caId: true,
isEnabled: true
})
})
}
},
handler: async (req) => {
const caEstConfig = await server.services.certificateAuthority.updateCaEstConfiguration({
caId: req.params.caId,
actor: req.permission.type,
actorId: req.permission.id,
actorAuthMethod: req.permission.authMethod,
actorOrgId: req.permission.orgId,
...req.body
});
return {
caEstConfig
};
}
});
server.route({
method: "GET",
url: "/:caId/est-config",
config: {
rateLimit: readLimit
},
onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
schema: {
description: "Get CA EST configuration",
params: z.object({
caId: z.string().trim()
}),
response: {
200: z.object({
caEstConfig: CertificateAuthorityEstConfigsSchema.pick({
caId: true,
isEnabled: true
}).merge(
z.object({
caChain: z.string()
})
)
})
}
},
handler: async (req) => {
const caEstConfig = await server.services.certificateAuthority.getCaEstConfiguration({
isInternal: false,
caId: req.params.caId,
actor: req.permission.type,
actorId: req.permission.id,
actorAuthMethod: req.permission.authMethod,
actorOrgId: req.permission.orgId
});
return {
caEstConfig
};
}
});
};

109
backend/src/server/routes/v1/certificate-template-router.ts
View File

@@ -1,6 +1,7 @@
import ms from "ms";
import { z } from "zod";
import { CertificateTemplateEstConfigsSchema } from "@app/db/schemas";
import { EventType } from "@app/ee/services/audit-log/audit-log-types";
import { CERTIFICATE_TEMPLATES } from "@app/lib/api-docs";
import { readLimit, writeLimit } from "@app/server/config/rateLimiter";
@@ -9,6 +10,12 @@ import { AuthMode } from "@app/services/auth/auth-type";
import { sanitizedCertificateTemplate } from "@app/services/certificate-template/certificate-template-schema";
import { validateTemplateRegexField } from "@app/services/certificate-template/certificate-template-validators";
const sanitizedEstConfig = CertificateTemplateEstConfigsSchema.pick({
id: true,
certificateTemplateId: true,
isEnabled: true
});
export const registerCertificateTemplateRouter = async (server: FastifyZodProvider) => {
server.route({
method: "GET",
@@ -202,4 +209,106 @@ export const registerCertificateTemplateRouter = async (server: FastifyZodProvid
return certificateTemplate;
}
});
server.route({
method: "POST",
url: "/:certificateTemplateId/est-config",
config: {
rateLimit: writeLimit
},
onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
schema: {
description: "Create Certificate Template EST configuration",
params: z.object({
certificateTemplateId: z.string().trim()
}),
body: z.object({
caChain: z.string().trim().min(1),
passphrase: z.string().min(1),
isEnabled: z.boolean().default(true)
}),
response: {
200: sanitizedEstConfig
}
},
handler: async (req) => {
const estConfig = await server.services.certificateTemplate.createEstConfiguration({
certificateTemplateId: req.params.certificateTemplateId,
actor: req.permission.type,
actorId: req.permission.id,
actorAuthMethod: req.permission.authMethod,
actorOrgId: req.permission.orgId,
...req.body
});
return estConfig;
}
});
server.route({
method: "PATCH",
url: "/:certificateTemplateId/est-config",
config: {
rateLimit: writeLimit
},
onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
schema: {
description: "Update Certificate Template EST configuration",
params: z.object({
certificateTemplateId: z.string().trim()
}),
body: z.object({
caChain: z.string().trim().min(1).optional(),
passphrase: z.string().min(1).optional(),
isEnabled: z.boolean().optional()
}),
response: {
200: sanitizedEstConfig
}
},
handler: async (req) => {
const estConfig = await server.services.certificateTemplate.updateEstConfiguration({
certificateTemplateId: req.params.certificateTemplateId,
actor: req.permission.type,
actorId: req.permission.id,
actorAuthMethod: req.permission.authMethod,
actorOrgId: req.permission.orgId,
...req.body
});
return estConfig;
}
});
server.route({
method: "GET",
url: "/:certificateTemplateId/est-config",
config: {
rateLimit: readLimit
},
onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
schema: {
description: "Get Certificate Template EST configuration",
params: z.object({
certificateTemplateId: z.string().trim()
}),
response: {
200: sanitizedEstConfig.extend({
caChain: z.string()
})
}
},
handler: async (req) => {
const estConfig = await server.services.certificateTemplate.getEstConfiguration({
isInternal: false,
certificateTemplateId: req.params.certificateTemplateId,
actor: req.permission.type,
actorId: req.permission.id,
actorAuthMethod: req.permission.authMethod,
actorOrgId: req.permission.orgId
});
return estConfig;
}
});
};

11
backend/src/services/certificate-authority/certificate-authority-est-config-dal.ts
View File

@@ -1,11 +0,0 @@
import { TDbClient } from "@app/db";
import { TableName } from "@app/db/schemas";
import { ormify } from "@app/lib/knex";
export type TCertificateAuthorityEstConfigDALFactory = ReturnType<typeof certificateAuthorityEstConfigDALFactory>;
export const certificateAuthorityEstConfigDALFactory = (db: TDbClient) => {
const caEstConfigOrm = ormify(db, TableName.CertificateAuthorityEstConfig);
return caEstConfigOrm;
};

199
backend/src/services/certificate-authority/certificate-authority-service.ts
View File

@@ -1,16 +1,13 @@
/* eslint-disable no-bitwise */
import { ForbiddenError } from "@casl/ability";
import * as x509 from "@peculiar/x509";
import bcrypt from "bcrypt";
import crypto, { KeyObject } from "crypto";
import ms from "ms";
import { z } from "zod";
import { TCertificateAuthorities, TCertificateTemplates } from "@app/db/schemas";
import { TCertificateAuthorityEstConfigsUpdate } from "@app/db/schemas/certificate-authority-est-configs";
import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
import { getConfig } from "@app/lib/config/env";
import { BadRequestError, NotFoundError } from "@app/lib/errors";
import { TCertificateBodyDALFactory } from "@app/services/certificate/certificate-body-dal";
import { TCertificateDALFactory } from "@app/services/certificate/certificate-dal";
@@ -26,7 +23,6 @@ import { TCertificateTemplateDALFactory } from "../certificate-template/certific
import { validateCertificateDetailsAgainstTemplate } from "../certificate-template/certificate-template-fns";
import { TCertificateAuthorityCertDALFactory } from "./certificate-authority-cert-dal";
import { TCertificateAuthorityDALFactory } from "./certificate-authority-dal";
import { TCertificateAuthorityEstConfigDALFactory } from "./certificate-authority-est-config-dal";
import {
createDistinguishedName,
getCaCertChain, // TODO: consider rename
@@ -41,20 +37,17 @@ import {
CaStatus,
CaType,
TCreateCaDTO,
TCreateCaEstConfigurationDTO,
TDeleteCaDTO,
TGetCaCertDTO,
TGetCaCertsDTO,
TGetCaCsrDTO,
TGetCaDTO,
TGetCaEstConfigurationDTO,
TImportCertToCaDTO,
TIssueCertFromCaDTO,
TRenewCaCertDTO,
TSignCertFromCaDTO,
TSignIntermediateDTO,
TUpdateCaDTO,
TUpdateCaEstConfigurationDTO
TUpdateCaDTO
} from "./certificate-authority-types";
import { hostnameRegex } from "./certificate-authority-validators";
@@ -71,7 +64,6 @@ type TCertificateAuthorityServiceFactoryDep = {
certificateAuthorityCrlDAL: Pick<TCertificateAuthorityCrlDALFactory, "create" | "findOne" | "update">;
certificateTemplateDAL: Pick<TCertificateTemplateDALFactory, "getById">;
certificateAuthorityQueue: TCertificateAuthorityQueueFactory; // TODO: Pick
certificateAuthorityEstConfigDAL: Pick<TCertificateAuthorityEstConfigDALFactory, "updateById" | "create" | "findOne">;
certificateDAL: Pick<TCertificateDALFactory, "transaction" | "create" | "find">;
certificateBodyDAL: Pick<TCertificateBodyDALFactory, "create">;
pkiCollectionDAL: Pick<TPkiCollectionDALFactory, "findById">;
@@ -87,7 +79,6 @@ export const certificateAuthorityServiceFactory = ({
certificateAuthorityDAL,
certificateAuthorityCertDAL,
certificateAuthoritySecretDAL,
certificateAuthorityEstConfigDAL,
certificateAuthorityCrlDAL,
certificateTemplateDAL,
certificateDAL,
@@ -1540,189 +1531,6 @@ export const certificateAuthorityServiceFactory = ({
};
};
const createCaEstConfiguration = async ({
caId,
caChain,
passphrase,
isEnabled,
actorId,
actorAuthMethod,
actor,
actorOrgId
}: TCreateCaEstConfigurationDTO) => {
const ca = await certificateAuthorityDAL.findById(caId);
if (!ca) {
throw new NotFoundError({ message: "CA not found" });
}
const { permission } = await permissionService.getProjectPermission(
actor,
actorId,
ca.projectId,
actorAuthMethod,
actorOrgId
);
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionActions.Edit,
ProjectPermissionSub.CertificateAuthorities
);
const appCfg = getConfig();
const certificateManagerKmsId = await getProjectKmsCertificateKeyId({
projectId: ca.projectId,
projectDAL,
kmsService
});
const kmsEncryptor = await kmsService.encryptWithKmsKey({
kmsId: certificateManagerKmsId
});
const { cipherTextBlob: encryptedCaChain } = await kmsEncryptor({
plainText: Buffer.from(caChain)
});
const hashedPassphrase = await bcrypt.hash(passphrase, appCfg.SALT_ROUNDS);
const estConfig = await certificateAuthorityEstConfigDAL.create({
caId,
hashedPassphrase,
encryptedCaChain,
isEnabled
});
return estConfig;
};
const updateCaEstConfiguration = async ({
caId,
caChain,
passphrase,
isEnabled,
actorId,
actorAuthMethod,
actor,
actorOrgId
}: TUpdateCaEstConfigurationDTO) => {
const ca = await certificateAuthorityDAL.findById(caId);
if (!ca) {
throw new NotFoundError({ message: "CA not found" });
}
const { permission } = await permissionService.getProjectPermission(
actor,
actorId,
ca.projectId,
actorAuthMethod,
actorOrgId
);
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionActions.Edit,
ProjectPermissionSub.CertificateAuthorities
);
const originalCaEstConfig = await certificateAuthorityEstConfigDAL.findOne({
caId
});
if (!originalCaEstConfig) {
throw new NotFoundError({
message: "CA EST Config not found"
});
}
const appCfg = getConfig();
const certificateManagerKmsId = await getProjectKmsCertificateKeyId({
projectId: ca.projectId,
projectDAL,
kmsService
});
const updatedData: TCertificateAuthorityEstConfigsUpdate = {
isEnabled
};
if (caChain) {
const kmsEncryptor = await kmsService.encryptWithKmsKey({
kmsId: certificateManagerKmsId
});
const { cipherTextBlob: encryptedCaChain } = await kmsEncryptor({
plainText: Buffer.from(caChain)
});
updatedData.encryptedCaChain = encryptedCaChain;
}
if (passphrase) {
const hashedPassphrase = await bcrypt.hash(passphrase, appCfg.SALT_ROUNDS);
updatedData.hashedPassphrase = hashedPassphrase;
}
const estConfig = await certificateAuthorityEstConfigDAL.updateById(originalCaEstConfig.id, updatedData);
return estConfig;
};
const getCaEstConfiguration = async (dto: TGetCaEstConfigurationDTO) => {
const ca = await certificateAuthorityDAL.findById(dto.caId);
if (!ca) {
throw new NotFoundError({ message: "CA not found" });
}
if (!dto.isInternal) {
const { permission } = await permissionService.getProjectPermission(
dto.actor,
dto.actorId,
ca.projectId,
dto.actorAuthMethod,
dto.actorOrgId
);
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionActions.Edit,
ProjectPermissionSub.CertificateAuthorities
);
}
const { caId } = dto;
const caEstConfig = await certificateAuthorityEstConfigDAL.findOne({
caId
});
if (!caEstConfig) {
throw new NotFoundError({
message: "CA EST Config not found"
});
}
const certificateManagerKmsId = await getProjectKmsCertificateKeyId({
projectId: ca.projectId,
projectDAL,
kmsService
});
const kmsDecryptor = await kmsService.decryptWithKmsKey({
kmsId: certificateManagerKmsId
});
const decryptedCaChain = await kmsDecryptor({
cipherTextBlob: caEstConfig.encryptedCaChain
});
return {
caId,
isEnabled: caEstConfig.isEnabled,
caChain: decryptedCaChain.toString(),
hashedPassphrase: caEstConfig.hashedPassphrase
};
};
return {
createCa,
getCaById,
@@ -1735,9 +1543,6 @@ export const certificateAuthorityServiceFactory = ({
signIntermediate,
importCertToCa,
issueCertFromCa,
signCertFromCa,
createCaEstConfiguration,
updateCaEstConfiguration,
getCaEstConfiguration
signCertFromCa
};
};

24
backend/src/services/certificate-authority/certificate-authority-types.ts
View File

@@ -172,27 +172,3 @@ export type TRotateCaCrlTriggerDTO = {
caId: string;
rotationIntervalDays: number;
};
export type TCreateCaEstConfigurationDTO = {
caId: string;
caChain: string;
passphrase: string;
isEnabled: boolean;
} & Omit<TProjectPermission, "projectId">;
export type TUpdateCaEstConfigurationDTO = {
caId: string;
caChain?: string;
passphrase?: string;
isEnabled?: boolean;
} & Omit<TProjectPermission, "projectId">;
export type TGetCaEstConfigurationDTO =
| {
isInternal: true;
caId: string;
}
| ({
isInternal: false;
caId: string;
} & Omit<TProjectPermission, "projectId">);

11
backend/src/services/certificate-template/certificate-template-est-config-dal.ts Normal file
View File

@@ -0,0 +1,11 @@
import { TDbClient } from "@app/db";
import { TableName } from "@app/db/schemas";
import { ormify } from "@app/lib/knex";
export type TCertificateTemplateEstConfigDALFactory = ReturnType<typeof certificateTemplateEstConfigDALFactory>;
export const certificateTemplateEstConfigDALFactory = (db: TDbClient) => {
const certificateTemplateEstConfigOrm = ormify(db, TableName.CertificateTemplateEstConfig);
return certificateTemplateEstConfigOrm;
};

214
backend/src/services/certificate-template/certificate-template-service.ts
View File

@@ -1,20 +1,33 @@
import { ForbiddenError } from "@casl/ability";
import bcrypt from "bcrypt";
import { TCertificateTemplateEstConfigsUpdate } from "@app/db/schemas";
import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
import { getConfig } from "@app/lib/config/env";
import { BadRequestError, NotFoundError } from "@app/lib/errors";
import { TCertificateAuthorityDALFactory } from "../certificate-authority/certificate-authority-dal";
import { TKmsServiceFactory } from "../kms/kms-service";
import { TProjectDALFactory } from "../project/project-dal";
import { getProjectKmsCertificateKeyId } from "../project/project-fns";
import { TCertificateTemplateDALFactory } from "./certificate-template-dal";
import { TCertificateTemplateEstConfigDALFactory } from "./certificate-template-est-config-dal";
import {
TCreateCertTemplateDTO,
TCreateEstConfigurationDTO,
TDeleteCertTemplateDTO,
TGetCertTemplateDTO,
TUpdateCertTemplateDTO
TGetEstConfigurationDTO,
TUpdateCertTemplateDTO,
TUpdateEstConfigurationDTO
} from "./certificate-template-types";
type TCertificateTemplateServiceFactoryDep = {
certificateTemplateDAL: TCertificateTemplateDALFactory;
certificateTemplateEstConfigDAL: TCertificateTemplateEstConfigDALFactory;
projectDAL: Pick<TProjectDALFactory, "findProjectBySlug" | "findOne" | "updateById" | "findById" | "transaction">;
kmsService: Pick<TKmsServiceFactory, "generateKmsKey" | "encryptWithKmsKey" | "decryptWithKmsKey">;
certificateAuthorityDAL: Pick<TCertificateAuthorityDALFactory, "findById">;
permissionService: Pick<TPermissionServiceFactory, "getProjectPermission">;
};
@@ -23,8 +36,11 @@ export type TCertificateTemplateServiceFactory = ReturnType<typeof certificateTe
export const certificateTemplateServiceFactory = ({
certificateTemplateDAL,
certificateTemplateEstConfigDAL,
certificateAuthorityDAL,
permissionService
permissionService,
kmsService,
projectDAL
}: TCertificateTemplateServiceFactoryDep) => {
const createCertTemplate = async ({
caId,
@@ -187,10 +203,202 @@ export const certificateTemplateServiceFactory = ({
return certTemplate;
};
const createEstConfiguration = async ({
certificateTemplateId,
caChain,
passphrase,
isEnabled,
actorId,
actorAuthMethod,
actor,
actorOrgId
}: TCreateEstConfigurationDTO) => {
const certTemplate = await certificateTemplateDAL.getById(certificateTemplateId);
if (!certTemplate) {
throw new NotFoundError({
message: "Certificate template not found."
});
}
const { permission } = await permissionService.getProjectPermission(
actor,
actorId,
certTemplate.projectId,
actorAuthMethod,
actorOrgId
);
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionActions.Edit,
ProjectPermissionSub.CertificateTemplates
);
const appCfg = getConfig();
const certificateManagerKmsId = await getProjectKmsCertificateKeyId({
projectId: certTemplate.projectId,
projectDAL,
kmsService
});
const kmsEncryptor = await kmsService.encryptWithKmsKey({
kmsId: certificateManagerKmsId
});
const { cipherTextBlob: encryptedCaChain } = await kmsEncryptor({
plainText: Buffer.from(caChain)
});
const hashedPassphrase = await bcrypt.hash(passphrase, appCfg.SALT_ROUNDS);
const estConfig = await certificateTemplateEstConfigDAL.create({
certificateTemplateId,
hashedPassphrase,
encryptedCaChain,
isEnabled
});
return estConfig;
};
const updateEstConfiguration = async ({
certificateTemplateId,
caChain,
passphrase,
isEnabled,
actorId,
actorAuthMethod,
actor,
actorOrgId
}: TUpdateEstConfigurationDTO) => {
const certTemplate = await certificateTemplateDAL.getById(certificateTemplateId);
if (!certTemplate) {
throw new NotFoundError({
message: "Certificate template not found."
});
}
const { permission } = await permissionService.getProjectPermission(
actor,
actorId,
certTemplate.projectId,
actorAuthMethod,
actorOrgId
);
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionActions.Edit,
ProjectPermissionSub.CertificateTemplates
);
const originalCaEstConfig = await certificateTemplateEstConfigDAL.findOne({
certificateTemplateId
});
if (!originalCaEstConfig) {
throw new NotFoundError({
message: "EST configuration not found"
});
}
const appCfg = getConfig();
const certificateManagerKmsId = await getProjectKmsCertificateKeyId({
projectId: certTemplate.projectId,
projectDAL,
kmsService
});
const updatedData: TCertificateTemplateEstConfigsUpdate = {
isEnabled
};
if (caChain) {
const kmsEncryptor = await kmsService.encryptWithKmsKey({
kmsId: certificateManagerKmsId
});
const { cipherTextBlob: encryptedCaChain } = await kmsEncryptor({
plainText: Buffer.from(caChain)
});
updatedData.encryptedCaChain = encryptedCaChain;
}
if (passphrase) {
const hashedPassphrase = await bcrypt.hash(passphrase, appCfg.SALT_ROUNDS);
updatedData.hashedPassphrase = hashedPassphrase;
}
const estConfig = await certificateTemplateEstConfigDAL.updateById(originalCaEstConfig.id, updatedData);
return estConfig;
};
const getEstConfiguration = async (dto: TGetEstConfigurationDTO) => {
const { certificateTemplateId } = dto;
const certTemplate = await certificateTemplateDAL.getById(certificateTemplateId);
if (!certTemplate) {
throw new NotFoundError({
message: "Certificate template not found."
});
}
if (!dto.isInternal) {
const { permission } = await permissionService.getProjectPermission(
dto.actor,
dto.actorId,
certTemplate.projectId,
dto.actorAuthMethod,
dto.actorOrgId
);
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionActions.Edit,
ProjectPermissionSub.CertificateTemplates
);
}
const estConfig = await certificateTemplateEstConfigDAL.findOne({
certificateTemplateId
});
if (!estConfig) {
throw new NotFoundError({
message: "EST configuration not found"
});
}
const certificateManagerKmsId = await getProjectKmsCertificateKeyId({
projectId: certTemplate.projectId,
projectDAL,
kmsService
});
const kmsDecryptor = await kmsService.decryptWithKmsKey({
kmsId: certificateManagerKmsId
});
const decryptedCaChain = await kmsDecryptor({
cipherTextBlob: estConfig.encryptedCaChain
});
return {
certificateTemplateId,
id: estConfig.id,
isEnabled: estConfig.isEnabled,
caChain: decryptedCaChain.toString(),
hashedPassphrase: estConfig.hashedPassphrase
};
};
return {
createCertTemplate,
getCertTemplate,
deleteCertTemplate,
updateCertTemplate
updateCertTemplate,
createEstConfiguration,
updateEstConfiguration,
getEstConfiguration
};
};

24
backend/src/services/certificate-template/certificate-template-types.ts
View File

@@ -26,3 +26,27 @@ export type TGetCertTemplateDTO = {
export type TDeleteCertTemplateDTO = {
id: string;
} & Omit<TProjectPermission, "projectId">;
export type TCreateEstConfigurationDTO = {
certificateTemplateId: string;
caChain: string;
passphrase: string;
isEnabled: boolean;
} & Omit<TProjectPermission, "projectId">;
export type TUpdateEstConfigurationDTO = {
certificateTemplateId: string;
caChain?: string;
passphrase?: string;
isEnabled?: boolean;
} & Omit<TProjectPermission, "projectId">;
export type TGetEstConfigurationDTO =
| {
isInternal: true;
certificateTemplateId: string;
}
| ({
isInternal: false;
certificateTemplateId: string;
} & Omit<TProjectPermission, "projectId">);

13
frontend/src/hooks/api/ca/index.tsx
View File

@@ -1,20 +1,11 @@
export { CaRenewalType, CaStatus, CaType } from "./enums";
export {
useCreateCa,
useCreateCaEstConfig,
useCreateCertificate,
useDeleteCa,
useImportCaCertificate,
useRenewCa,
useSignIntermediate,
useUpdateCa,
useUpdateCaEstConfig
useUpdateCa
} from "./mutations";
export {
useGetCaById,
useGetCaCert,
useGetCaCerts,
useGetCaCrl,
useGetCaCsr,
useGetCaEstConfig
} from "./queries";
export { useGetCaById, useGetCaCert, useGetCaCerts, useGetCaCrl, useGetCaCsr } from "./queries";

30
frontend/src/hooks/api/ca/mutations.tsx
View File

@@ -7,7 +7,6 @@ import { caKeys } from "./queries";
import {
TCertificateAuthority,
TCreateCaDTO,
TCreateCaEstConfigDTO,
TCreateCertificateDTO,
TCreateCertificateResponse,
TDeleteCaDTO,
@@ -17,8 +16,7 @@ import {
TRenewCaResponse,
TSignIntermediateDTO,
TSignIntermediateResponse,
TUpdateCaDTO,
TUpdateCaEstConfigDTO
TUpdateCaDTO
} from "./types";
export const useCreateCa = () => {
@@ -134,29 +132,3 @@ export const useRenewCa = () => {
}
});
};
export const useCreateCaEstConfig = () => {
const queryClient = useQueryClient();
return useMutation<{}, {}, TCreateCaEstConfigDTO>({
mutationFn: async (body) => {
const { data } = await apiRequest.post(`/api/v1/pki/ca/${body.caId}/est-config`, body);
return data;
},
onSuccess: (_, { caId }) => {
queryClient.invalidateQueries(caKeys.getCaEstConfig(caId));
}
});
};
export const useUpdateCaEstConfig = () => {
const queryClient = useQueryClient();
return useMutation<{}, {}, TUpdateCaEstConfigDTO>({
mutationFn: async (body) => {
const { data } = await apiRequest.patch(`/api/v1/pki/ca/${body.caId}/est-config`, body);
return data;
},
onSuccess: (_, { caId }) => {
queryClient.invalidateQueries(caKeys.getCaEstConfig(caId));
}
});
};

18
frontend/src/hooks/api/ca/queries.tsx
View File

@@ -2,7 +2,7 @@ import { useQuery } from "@tanstack/react-query";
import { apiRequest } from "@app/config/request";
import { TCaEstConfig, TCertificateAuthority } from "./types";
import { TCertificateAuthority } from "./types";
export const caKeys = {
getCaById: (caId: string) => [{ caId }, "ca"],
@@ -88,19 +88,3 @@ export const useGetCaCrl = (caId: string) => {
enabled: Boolean(caId)
});
};
export const useGetCaEstConfig = (caId: string) => {
return useQuery({
queryKey: caKeys.getCaEstConfig(caId),
queryFn: async () => {
const {
data: { caEstConfig }
} = await apiRequest.get<{
caEstConfig: TCaEstConfig;
}>(`/api/v1/pki/ca/${caId}/est-config`);
return caEstConfig;
},
enabled: Boolean(caId)
});
};

20
frontend/src/hooks/api/ca/types.ts
View File

@@ -110,23 +110,3 @@ export type TRenewCaResponse = {
certificateChain: string;
serialNumber: string;
};
export type TCaEstConfig = {
caId: string;
caChain: string;
isEnabled: false;
};
export type TCreateCaEstConfigDTO = {
caId: string;
caChain: string;
passphrase: string;
isEnabled: boolean;
};
export type TUpdateCaEstConfigDTO = {
caId: string;
caChain?: string;
passphrase?: string;
isEnabled?: boolean;
};

10
frontend/src/hooks/api/certificateTemplates/index.tsx
View File

@@ -1,2 +1,8 @@
export { useCreateCertTemplate, useDeleteCertTemplate, useUpdateCertTemplate } from "./mutations";
export { useGetCertTemplate } from "./queries";
export {
useCreateCertTemplate,
useCreateEstConfig,
useDeleteCertTemplate,
useUpdateCertTemplate,
useUpdateEstConfig
} from "./mutations";
export { useGetCertTemplate, useGetEstConfig } from "./queries";

36
frontend/src/hooks/api/certificateTemplates/mutations.tsx
View File

@@ -7,8 +7,10 @@ import { certTemplateKeys } from "./queries";
import {
TCertificateTemplate,
TCreateCertificateTemplateDTO,
TCreateEstConfigDTO,
TDeleteCertificateTemplateDTO,
TUpdateCertificateTemplateDTO
TUpdateCertificateTemplateDTO,
TUpdateEstConfigDTO
} from "./types";
export const useCreateCertTemplate = () => {
@@ -57,3 +59,35 @@ export const useDeleteCertTemplate = () => {
}
});
};
export const useCreateEstConfig = () => {
const queryClient = useQueryClient();
return useMutation<{}, {}, TCreateEstConfigDTO>({
mutationFn: async (body) => {
const { data } = await apiRequest.post(
`/api/v1/pki/certificate-templates/${body.certificateTemplateId}/est-config`,
body
);
return data;
},
onSuccess: (_, { certificateTemplateId }) => {
queryClient.invalidateQueries(certTemplateKeys.getEstConfig(certificateTemplateId));
}
});
};
export const useUpdateEstConfig = () => {
const queryClient = useQueryClient();
return useMutation<{}, {}, TUpdateEstConfigDTO>({
mutationFn: async (body) => {
const { data } = await apiRequest.patch(
`/api/v1/pki/certificate-templates/${body.certificateTemplateId}/est-config`,
body
);
return data;
},
onSuccess: (_, { certificateTemplateId }) => {
queryClient.invalidateQueries(certTemplateKeys.getEstConfig(certificateTemplateId));
}
});
};

19
frontend/src/hooks/api/certificateTemplates/queries.tsx
View File

@@ -2,10 +2,11 @@ import { useQuery } from "@tanstack/react-query";
import { apiRequest } from "@app/config/request";
import { TCertificateTemplate } from "./types";
import { TCertificateTemplate, TEstConfig } from "./types";
export const certTemplateKeys = {
getCertTemplateById: (id: string) => [{ id }, "cert-template"]
getCertTemplateById: (id: string) => [{ id }, "cert-template"],
getEstConfig: (id: string) => [{ id }, "cert-template-est-config"]
};
export const useGetCertTemplate = (id: string) => {
@@ -20,3 +21,17 @@ export const useGetCertTemplate = (id: string) => {
enabled: Boolean(id)
});
};
export const useGetEstConfig = (certificateTemplateId: string) => {
return useQuery({
queryKey: certTemplateKeys.getEstConfig(certificateTemplateId),
queryFn: async () => {
const { data: estConfig } = await apiRequest.get<TEstConfig>(
`/api/v1/pki/certificate-templates/${certificateTemplateId}/est-config`
);
return estConfig;
},
enabled: Boolean(certificateTemplateId)
});
};

21
frontend/src/hooks/api/certificateTemplates/types.ts
View File

@@ -35,3 +35,24 @@ export type TDeleteCertificateTemplateDTO = {
id: string;
projectId: string;
};
export type TCreateEstConfigDTO = {
certificateTemplateId: string;
caChain: string;
passphrase: string;
isEnabled: boolean;
};
export type TUpdateEstConfigDTO = {
certificateTemplateId: string;
caChain?: string;
passphrase?: string;
isEnabled?: boolean;
};
export type TEstConfig = {
id: string;
certificateTemplateId: string;
caChain: string;
isEnabled: false;
};

22
frontend/src/views/Project/CaPage/components/CaEnrollmentModal.tsx → frontend/src/views/Project/CertificatesPage/components/CertificatesTab/components/CertificateTemplateEnrollmentModal.tsx
View File

@@ -15,7 +15,7 @@ import {
Switch,
TextArea
} from "@app/components/v2";
import { useCreateCaEstConfig, useGetCaEstConfig, useUpdateCaEstConfig } from "@app/hooks/api";
import { useCreateEstConfig, useGetEstConfig, useUpdateEstConfig } from "@app/hooks/api";
import { UsePopUpState } from "@app/hooks/usePopUp";
enum EnrollmentMethod {
@@ -39,13 +39,13 @@ const schema = z.object({
export type FormData = z.infer<typeof schema>;
export const CaEnrollmentModal = ({ popUp, handlePopUpToggle }: Props) => {
export const CertificateTemplateEnrollmentModal = ({ popUp, handlePopUpToggle }: Props) => {
const popUpData = popUp?.enrollmentOptions?.data as {
caId: string;
id: string;
};
const caId = popUpData?.caId;
const certificateTemplateId = popUpData?.id;
const { data } = useGetCaEstConfig(caId);
const { data } = useGetEstConfig(certificateTemplateId);
const {
control,
@@ -57,8 +57,8 @@ export const CaEnrollmentModal = ({ popUp, handlePopUpToggle }: Props) => {
resolver: zodResolver(schema)
});
const { mutateAsync: createCaEstConfig } = useCreateCaEstConfig();
const { mutateAsync: updateCaEstConfig } = useUpdateCaEstConfig();
const { mutateAsync: createEstConfig } = useCreateEstConfig();
const { mutateAsync: updateEstConfig } = useUpdateEstConfig();
useEffect(() => {
if (data) {
@@ -77,8 +77,8 @@ export const CaEnrollmentModal = ({ popUp, handlePopUpToggle }: Props) => {
const onFormSubmit = async ({ caChain, passphrase, isEnabled }: FormData) => {
try {
if (data) {
await updateCaEstConfig({
caId,
await updateEstConfig({
certificateTemplateId,
caChain,
passphrase,
isEnabled
@@ -89,8 +89,8 @@ export const CaEnrollmentModal = ({ popUp, handlePopUpToggle }: Props) => {
return;
}
await createCaEstConfig({
caId,
await createEstConfig({
certificateTemplateId,
caChain,
passphrase,
isEnabled

5
frontend/src/views/Project/CertificatesPage/components/CertificatesTab/components/CertificateTemplatesSection.tsx
View File

@@ -8,13 +8,15 @@ import { ProjectPermissionActions, ProjectPermissionSub, useWorkspace } from "@a
import { usePopUp } from "@app/hooks";
import { useDeleteCertTemplate } from "@app/hooks/api";
import { CertificateTemplateEnrollmentModal } from "./CertificateTemplateEnrollmentModal";
import { CertificateTemplateModal } from "./CertificateTemplateModal";
import { CertificateTemplatesTable } from "./CertificateTemplatesTable";
export const CertificateTemplatesSection = () => {
const { popUp, handlePopUpOpen, handlePopUpClose, handlePopUpToggle } = usePopUp([
"certificateTemplate",
"deleteCertificateTemplate"
"deleteCertificateTemplate",
"enrollmentOptions"
] as const);
const { currentWorkspace } = useWorkspace();
@@ -69,6 +71,7 @@ export const CertificateTemplatesSection = () => {
</div>
<CertificateTemplatesTable handlePopUpOpen={handlePopUpOpen} />
<CertificateTemplateModal popUp={popUp} handlePopUpToggle={handlePopUpToggle} />
<CertificateTemplateEnrollmentModal popUp={popUp} handlePopUpToggle={handlePopUpToggle} />
<DeleteActionModal
isOpen={popUp.deleteCertificateTemplate.isOpen}
title={`Are you sure want to delete the certificate template ${

16
frontend/src/views/Project/CertificatesPage/components/CertificatesTab/components/CertificateTemplatesTable.tsx
View File

@@ -1,4 +1,4 @@
import { faEllipsis, faFileAlt, faTrash } from "@fortawesome/free-solid-svg-icons";
import { faEllipsis, faFileAlt, faTrash, faUserPlus } from "@fortawesome/free-solid-svg-icons";
import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
import { twMerge } from "tailwind-merge";
@@ -25,7 +25,9 @@ import { UsePopUpState } from "@app/hooks/usePopUp";
type Props = {
handlePopUpOpen: (
popUpName: keyof UsePopUpState<["certificateTemplate", "deleteCertificateTemplate"]>,
popUpName: keyof UsePopUpState<
["certificateTemplate", "deleteCertificateTemplate", "enrollmentOptions"]
>,
data?: {
id?: string;
name?: string;
@@ -78,6 +80,16 @@ export const CertificateTemplatesTable = ({ handlePopUpOpen }: Props) => {
>
Manage Policies
</DropdownMenuItem>
<DropdownMenuItem
onClick={() =>
handlePopUpOpen("enrollmentOptions", {
id: certificateTemplate.id
})
}
icon={<FontAwesomeIcon icon={faUserPlus} />}
>
Manage Enrollment
</DropdownMenuItem>
<ProjectPermissionCan
I={ProjectPermissionActions.Delete}
a={ProjectPermissionSub.CertificateTemplates}