misc: updated est configuration to be binded to certificate template

2026-10-15 04:14:38 +00:00 · 2024-08-19 19:26:20 +08:00
parent 3a4f8c2e54
commit 692bdc060c
26 changed files with 508 additions and 493 deletions
@@ -39,13 +39,13 @@ export const registerCertificateEstRouter = async (server: FastifyZodProvider) =
    }

    const urlFragments = req.url.split("/");
-    const certificateAuthorityId = urlFragments.slice(-2)[0];
-    const caEstConfig = await server.services.certificateAuthority.getCaEstConfiguration({
+    const certificateTemplateId = urlFragments.slice(-2)[0];
+    const estConfig = await server.services.certificateTemplate.getEstConfiguration({
      isInternal: true,
-      caId: certificateAuthorityId
+      certificateTemplateId
    });

-    if (!caEstConfig.isEnabled) {
+    if (!estConfig.isEnabled) {
      throw new BadRequestError({
        message: "EST enrollment is disabled"
      });
@@ -68,7 +68,7 @@ export const registerCertificateEstRouter = async (server: FastifyZodProvider) =
      .trim();

    // validate SSL client cert against configured CA
-    const chainCerts = caEstConfig.caChain
+    const chainCerts = estConfig.caChain
      .match(/-----BEGIN CERTIFICATE-----[\s\S]+?-----END CERTIFICATE-----/g)
      ?.map((cert) => {
        const processedBody = cert
@@ -122,7 +122,7 @@ export const registerCertificateEstRouter = async (server: FastifyZodProvider) =
      });
    }

-    const isPasswordValid = await bcrypt.compare(password, caEstConfig.hashedPassphrase);
+    const isPasswordValid = await bcrypt.compare(password, estConfig.hashedPassphrase);
    if (!isPasswordValid) {
      throw new UnauthorizedError({
        message: "Invalid credentials"
@@ -86,11 +86,11 @@ import { certificateDALFactory } from "@app/services/certificate/certificate-dal
 import { certificateServiceFactory } from "@app/services/certificate/certificate-service";
 import { certificateAuthorityCertDALFactory } from "@app/services/certificate-authority/certificate-authority-cert-dal";
 import { certificateAuthorityDALFactory } from "@app/services/certificate-authority/certificate-authority-dal";
-import { certificateAuthorityEstConfigDALFactory } from "@app/services/certificate-authority/certificate-authority-est-config-dal";
 import { certificateAuthorityQueueFactory } from "@app/services/certificate-authority/certificate-authority-queue";
 import { certificateAuthoritySecretDALFactory } from "@app/services/certificate-authority/certificate-authority-secret-dal";
 import { certificateAuthorityServiceFactory } from "@app/services/certificate-authority/certificate-authority-service";
 import { certificateTemplateDALFactory } from "@app/services/certificate-template/certificate-template-dal";
+import { certificateTemplateEstConfigDALFactory } from "@app/services/certificate-template/certificate-template-est-config-dal";
 import { certificateTemplateServiceFactory } from "@app/services/certificate-template/certificate-template-service";
 import { groupProjectDALFactory } from "@app/services/group-project/group-project-dal";
 import { groupProjectMembershipRoleDALFactory } from "@app/services/group-project/group-project-membership-role-dal";
@@ -591,8 +591,8 @@ export const registerRoutes = async (
  const certificateAuthorityCertDAL = certificateAuthorityCertDALFactory(db);
  const certificateAuthoritySecretDAL = certificateAuthoritySecretDALFactory(db);
  const certificateAuthorityCrlDAL = certificateAuthorityCrlDALFactory(db);
-  const certificateAuthorityEstConfigDAL = certificateAuthorityEstConfigDALFactory(db);
  const certificateTemplateDAL = certificateTemplateDALFactory(db);
+  const certificateTemplateEstConfigDAL = certificateTemplateEstConfigDALFactory(db);

  const certificateDAL = certificateDALFactory(db);
  const certificateBodyDAL = certificateBodyDALFactory(db);
@@ -636,8 +636,7 @@ export const registerRoutes = async (
    pkiCollectionItemDAL,
    projectDAL,
    kmsService,
-    permissionService,
-    certificateAuthorityEstConfigDAL
+    permissionService
  });

  const certificateAuthorityCrlService = certificateAuthorityCrlServiceFactory({
@@ -651,8 +650,11 @@ export const registerRoutes = async (

  const certificateTemplateService = certificateTemplateServiceFactory({
    certificateTemplateDAL,
+    certificateTemplateEstConfigDAL,
    certificateAuthorityDAL,
-    permissionService
+    permissionService,
+    kmsService,
+    projectDAL
  });

  const pkiAlertService = pkiAlertServiceFactory({
@@ -2,7 +2,6 @@ import ms from "ms";
 import { z } from "zod";

 import { CertificateAuthoritiesSchema } from "@app/db/schemas";
-import { CertificateAuthorityEstConfigsSchema } from "@app/db/schemas/certificate-authority-est-configs";
 import { EventType } from "@app/ee/services/audit-log/audit-log-types";
 import { CERTIFICATE_AUTHORITIES } from "@app/lib/api-docs";
 import { readLimit, writeLimit } from "@app/server/config/rateLimiter";
@@ -700,129 +699,4 @@ export const registerCaRouter = async (server: FastifyZodProvider) => {
      };
    }
  });
-
-  server.route({
-    method: "POST",
-    url: "/:caId/est-config",
-    config: {
-      rateLimit: writeLimit
-    },
-    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
-    schema: {
-      description: "Create CA EST configuration",
-      params: z.object({
-        caId: z.string().trim()
-      }),
-      body: z.object({
-        caChain: z.string().trim().min(1),
-        passphrase: z.string().min(1),
-        isEnabled: z.boolean().default(true)
-      }),
-      response: {
-        200: z.object({
-          caEstConfig: CertificateAuthorityEstConfigsSchema.pick({
-            caId: true,
-            isEnabled: true
-          })
-        })
-      }
-    },
-    handler: async (req) => {
-      const caEstConfig = await server.services.certificateAuthority.createCaEstConfiguration({
-        caId: req.params.caId,
-        actor: req.permission.type,
-        actorId: req.permission.id,
-        actorAuthMethod: req.permission.authMethod,
-        actorOrgId: req.permission.orgId,
-        ...req.body
-      });
-
-      return {
-        caEstConfig
-      };
-    }
-  });
-
-  server.route({
-    method: "PATCH",
-    url: "/:caId/est-config",
-    config: {
-      rateLimit: writeLimit
-    },
-    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
-    schema: {
-      description: "Update CA EST configuration",
-      params: z.object({
-        caId: z.string().trim()
-      }),
-      body: z.object({
-        caChain: z.string().trim().min(1).optional(),
-        passphrase: z.string().min(1).optional(),
-        isEnabled: z.boolean().optional()
-      }),
-      response: {
-        200: z.object({
-          caEstConfig: CertificateAuthorityEstConfigsSchema.pick({
-            caId: true,
-            isEnabled: true
-          })
-        })
-      }
-    },
-    handler: async (req) => {
-      const caEstConfig = await server.services.certificateAuthority.updateCaEstConfiguration({
-        caId: req.params.caId,
-        actor: req.permission.type,
-        actorId: req.permission.id,
-        actorAuthMethod: req.permission.authMethod,
-        actorOrgId: req.permission.orgId,
-        ...req.body
-      });
-
-      return {
-        caEstConfig
-      };
-    }
-  });
-
-  server.route({
-    method: "GET",
-    url: "/:caId/est-config",
-    config: {
-      rateLimit: readLimit
-    },
-    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
-    schema: {
-      description: "Get CA EST configuration",
-      params: z.object({
-        caId: z.string().trim()
-      }),
-      response: {
-        200: z.object({
-          caEstConfig: CertificateAuthorityEstConfigsSchema.pick({
-            caId: true,
-            isEnabled: true
-          }).merge(
-            z.object({
-              caChain: z.string()
-            })
-          )
-        })
-      }
-    },
-    handler: async (req) => {
-      const caEstConfig = await server.services.certificateAuthority.getCaEstConfiguration({
-        isInternal: false,
-        caId: req.params.caId,
-        actor: req.permission.type,
-        actorId: req.permission.id,
-        actorAuthMethod: req.permission.authMethod,
-        actorOrgId: req.permission.orgId
-      });
-
-      return {
-        caEstConfig
-      };
-    }
-  });
 };
@@ -1,6 +1,7 @@
 import ms from "ms";
 import { z } from "zod";

+import { CertificateTemplateEstConfigsSchema } from "@app/db/schemas";
 import { EventType } from "@app/ee/services/audit-log/audit-log-types";
 import { CERTIFICATE_TEMPLATES } from "@app/lib/api-docs";
 import { readLimit, writeLimit } from "@app/server/config/rateLimiter";
@@ -9,6 +10,12 @@ import { AuthMode } from "@app/services/auth/auth-type";
 import { sanitizedCertificateTemplate } from "@app/services/certificate-template/certificate-template-schema";
 import { validateTemplateRegexField } from "@app/services/certificate-template/certificate-template-validators";

+const sanitizedEstConfig = CertificateTemplateEstConfigsSchema.pick({
+  id: true,
+  certificateTemplateId: true,
+  isEnabled: true
+});
+
 export const registerCertificateTemplateRouter = async (server: FastifyZodProvider) => {
  server.route({
    method: "GET",
@@ -202,4 +209,106 @@ export const registerCertificateTemplateRouter = async (server: FastifyZodProvid
      return certificateTemplate;
    }
  });
+
+  server.route({
+    method: "POST",
+    url: "/:certificateTemplateId/est-config",
+    config: {
+      rateLimit: writeLimit
+    },
+    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
+    schema: {
+      description: "Create Certificate Template EST configuration",
+      params: z.object({
+        certificateTemplateId: z.string().trim()
+      }),
+      body: z.object({
+        caChain: z.string().trim().min(1),
+        passphrase: z.string().min(1),
+        isEnabled: z.boolean().default(true)
+      }),
+      response: {
+        200: sanitizedEstConfig
+      }
+    },
+    handler: async (req) => {
+      const estConfig = await server.services.certificateTemplate.createEstConfiguration({
+        certificateTemplateId: req.params.certificateTemplateId,
+        actor: req.permission.type,
+        actorId: req.permission.id,
+        actorAuthMethod: req.permission.authMethod,
+        actorOrgId: req.permission.orgId,
+        ...req.body
+      });
+
+      return estConfig;
+    }
+  });
+
+  server.route({
+    method: "PATCH",
+    url: "/:certificateTemplateId/est-config",
+    config: {
+      rateLimit: writeLimit
+    },
+    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
+    schema: {
+      description: "Update Certificate Template EST configuration",
+      params: z.object({
+        certificateTemplateId: z.string().trim()
+      }),
+      body: z.object({
+        caChain: z.string().trim().min(1).optional(),
+        passphrase: z.string().min(1).optional(),
+        isEnabled: z.boolean().optional()
+      }),
+      response: {
+        200: sanitizedEstConfig
+      }
+    },
+    handler: async (req) => {
+      const estConfig = await server.services.certificateTemplate.updateEstConfiguration({
+        certificateTemplateId: req.params.certificateTemplateId,
+        actor: req.permission.type,
+        actorId: req.permission.id,
+        actorAuthMethod: req.permission.authMethod,
+        actorOrgId: req.permission.orgId,
+        ...req.body
+      });
+
+      return estConfig;
+    }
+  });
+
+  server.route({
+    method: "GET",
+    url: "/:certificateTemplateId/est-config",
+    config: {
+      rateLimit: readLimit
+    },
+    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
+    schema: {
+      description: "Get Certificate Template EST configuration",
+      params: z.object({
+        certificateTemplateId: z.string().trim()
+      }),
+      response: {
+        200: sanitizedEstConfig.extend({
+          caChain: z.string()
+        })
+      }
+    },
+    handler: async (req) => {
+      const estConfig = await server.services.certificateTemplate.getEstConfiguration({
+        isInternal: false,
+        certificateTemplateId: req.params.certificateTemplateId,
+        actor: req.permission.type,
+        actorId: req.permission.id,
+        actorAuthMethod: req.permission.authMethod,
+        actorOrgId: req.permission.orgId
+      });
+
+      return estConfig;
+    }
+  });
 };