awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-09-22 13:39:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

misc: addressed first set of review comments

Browse Source
This commit is contained in:
Sheen Capadngan
2025-05-22 00:22:49 +08:00
parent 77b42836e7
commit 77de085ffc
32 changed files with 339 additions and 252 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
backend/src/db/migrations/20250521110635_add-external-ca-pki.ts
View File

@@ -24,6 +24,7 @@ export async function up(knex: Knex): Promise<void> {
t.dropColumn("requireTemplateForIssuance");
t.dropColumn("createdAt");
t.dropColumn("updatedAt");
t.dropColumn("status");
t.uuid("parentCaId")
.nullable()
.references("id")
@@ -44,22 +45,18 @@ export async function up(knex: Knex): Promise<void> {
await Promise.all(
cas.map((ca) => {
const slugifiedName = ca.friendlyName
? slugify(`${ca.friendlyName}-${alphaNumericNanoId(8)}`)
? slugify(`${ca.friendlyName.slice(0, 16)}-${alphaNumericNanoId(8)}`)
: slugify(alphaNumericNanoId(12));
return (
knex(TableName.CertificateAuthority)
.where({ id: ca.id })
// @ts-expect-error intentional: migration
.update({ name: slugifiedName, enableDirectIssuance: !ca.enableDirectIssuance })
);
return knex(TableName.CertificateAuthority)
.where({ id: ca.id })
.update({ name: slugifiedName, enableDirectIssuance: !ca.enableDirectIssuance });
})
);
await knex.schema.alterTable(TableName.CertificateAuthority, (t) => {
t.dropColumn("parentCaId");
t.dropColumn("type");
t.dropColumn("status");
t.dropColumn("friendlyName");
t.dropColumn("organization");
t.dropColumn("ou");
@@ -74,6 +71,7 @@ export async function up(knex: Knex): Promise<void> {
t.dropColumn("notBefore");
t.dropColumn("notAfter");
t.dropColumn("activeCaCertId");
t.boolean("enableDirectIssuance").notNullable().defaultTo(true).alter();
t.string("name").notNullable().alter();
t.unique(["name", "projectId"]);
});
@@ -90,7 +88,6 @@ export async function up(knex: Knex): Promise<void> {
t.uuid("caId").notNullable().references("id").inTable(TableName.CertificateAuthority).onDelete("CASCADE");
t.binary("credentials");
t.json("configuration");
t.string("status").notNullable();
});
}
@@ -114,7 +111,6 @@ export async function down(knex: Knex): Promise<void> {
await knex.schema.alterTable(TableName.CertificateAuthority, (t) => {
t.uuid("parentCaId").nullable().references("id").inTable(TableName.CertificateAuthority).onDelete("CASCADE");
t.string("type").nullable();
t.string("status").nullable();
t.string("friendlyName").nullable();
t.string("organization").nullable();
t.string("ou").nullable();
@@ -150,7 +146,6 @@ export async function down(knex: Knex): Promise<void> {
UPDATE ${TableName.CertificateAuthority} ca
SET
type = ica.type,
status = ica.status,
"friendlyName" = ica."friendlyName",
organization = ica.organization,
ou = ica.ou,
@@ -172,7 +167,6 @@ export async function down(knex: Knex): Promise<void> {
await knex.schema.alterTable(TableName.CertificateAuthority, (t) => {
t.string("type").notNullable().alter();
t.string("status").notNullable().alter();
t.string("friendlyName").notNullable().alter();
t.string("organization").notNullable().alter();
t.string("ou").notNullable().alter();
@@ -182,6 +176,7 @@ export async function down(knex: Knex): Promise<void> {
t.string("commonName").notNullable().alter();
t.string("dn").notNullable().alter();
t.string("keyAlgorithm").notNullable().alter();
t.boolean("requireTemplateForIssuance").notNullable().defaultTo(false).alter();
});
await knex.schema.dropTable(TableName.InternalCertificateAuthority);

4
backend/src/db/schemas/certificate-authorities.ts
View File

@@ -12,7 +12,9 @@ export const CertificateAuthoritiesSchema = z.object({
createdAt: z.date(),
updatedAt: z.date(),
projectId: z.string(),
disableDirectIssuance: z.boolean().default(false)
enableDirectIssuance: z.boolean().default(true),
status: z.string(),
name: z.string()
});
export type TCertificateAuthorities = z.infer<typeof CertificateAuthoritiesSchema>;

7
backend/src/db/schemas/external-certificate-authorities.ts
View File

@@ -12,14 +12,11 @@ import { TImmutableDBKeys } from "./models";
export const ExternalCertificateAuthoritiesSchema = z.object({
id: z.string().uuid(),
type: z.string(),
name: z.string(),
projectId: z.string(),
appConnectionId: z.string().uuid().nullable().optional(),
dnsAppConnectionId: z.string().uuid().nullable().optional(),
certificateAuthorityId: z.string().uuid(),
caId: z.string().uuid(),
credentials: zodBuffer.nullable().optional(),
configuration: z.unknown().nullable().optional(),
status: z.string()
configuration: z.unknown().nullable().optional()
});
export type TExternalCertificateAuthorities = z.infer<typeof ExternalCertificateAuthoritiesSchema>;

3
backend/src/db/schemas/internal-certificate-authorities.ts
View File

@@ -11,7 +11,6 @@ export const InternalCertificateAuthoritiesSchema = z.object({
id: z.string().uuid(),
parentCaId: z.string().uuid().nullable().optional(),
type: z.string(),
status: z.string(),
friendlyName: z.string(),
organization: z.string(),
ou: z.string(),
@@ -26,7 +25,7 @@ export const InternalCertificateAuthoritiesSchema = z.object({
notBefore: z.date().nullable().optional(),
notAfter: z.date().nullable().optional(),
activeCaCertId: z.string().uuid().nullable().optional(),
certificateAuthorityId: z.string().uuid()
caId: z.string().uuid()
});
export type TInternalCertificateAuthorities = z.infer<typeof InternalCertificateAuthoritiesSchema>;

7
backend/src/lib/api-docs/constants.ts
View File

@@ -1793,7 +1793,7 @@ export const PKI_SUBSCRIBERS = {
subscriberName: "The name of the PKI subscriber to get.",
projectId: "The ID of the project to get the PKI subscriber for."
},
GET_ACTIVE_CERT_BUNDLE: {
GET_LATEST_CERT_BUNDLE: {
subscriberName: "The name of the PKI subscriber to get the active certificate bundle for.",
projectId: "The ID of the project to get the active certificate bundle for.",
certificate: "The active certificate for the subscriber.",
@@ -2018,13 +2018,14 @@ export const CertificateAuthorities = {
CREATE: (type: CaType) => ({
name: `The name of the ${CERTIFICATE_AUTHORITIES_TYPE_MAP[type]} Certificate Authority to create. Must be slug-friendly.`,
projectId: `The ID of the project to create the Certificate Authority in.`,
disableDirectIssuance: `Whether or not to disable direct issuance of certificates for the ${CERTIFICATE_AUTHORITIES_TYPE_MAP[type]} Certificate Authority.`,
enableDirectIssuance: `Whether or not to enable direct issuance of certificates for the ${CERTIFICATE_AUTHORITIES_TYPE_MAP[type]} Certificate Authority.`,
status: `The status of the ${CERTIFICATE_AUTHORITIES_TYPE_MAP[type]} Certificate Authority.`
}),
UPDATE: (type: CaType) => ({
caId: `The ID of the ${CERTIFICATE_AUTHORITIES_TYPE_MAP[type]} Certificate Authority to update.`,
projectId: `The ID of the project to update the Certificate Authority in.`,
name: `The updated name of the ${CERTIFICATE_AUTHORITIES_TYPE_MAP[type]} Certificate Authority. Must be slug-friendly.`,
disableDirectIssuance: `Whether or not to disable direct issuance of certificates for the ${CERTIFICATE_AUTHORITIES_TYPE_MAP[type]} Certificate Authority.`,
enableDirectIssuance: `Whether or not to enable direct issuance of certificates for the ${CERTIFICATE_AUTHORITIES_TYPE_MAP[type]} Certificate Authority.`,
status: `The updated status of the ${CERTIFICATE_AUTHORITIES_TYPE_MAP[type]} Certificate Authority.`
}),
CONFIGURATIONS: {

1
backend/src/server/routes/sanitizedSchemas.ts
View File

@@ -277,6 +277,7 @@ export const SanitizedTagSchema = SecretTagsSchema.pick({
export const InternalCertificateAuthorityResponseSchema = CertificateAuthoritiesSchema.merge(
InternalCertificateAuthoritiesSchema.omit({
caId: true,
notAfter: true,
notBefore: true
})

66
backend/src/server/routes/v1/certificate-authority-routers/certificate-authority-endpoints.ts
View File

@@ -28,13 +28,14 @@ export const registerCertificateAuthorityEndpoints = <
projectId: string;
status: CaStatus;
configuration: I["configuration"];
disableDirectIssuance: boolean;
enableDirectIssuance: boolean;
}>;
updateSchema: z.ZodType<{
projectId: string;
name?: string;
status?: CaStatus;
configuration?: I["configuration"];
disableDirectIssuance?: boolean;
enableDirectIssuance?: boolean;
}>;
responseSchema: z.ZodTypeAny;
}) => {
@@ -51,7 +52,7 @@ export const registerCertificateAuthorityEndpoints = <
projectId: z.string().trim().min(1, "Project ID required")
}),
response: {
200: z.object({ certificateAuthorities: responseSchema.array() })
200: responseSchema.array()
}
},
onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
@@ -76,13 +77,13 @@ export const registerCertificateAuthorityEndpoints = <
}
});
return { certificateAuthorities };
return certificateAuthorities;
}
});
server.route({
method: "GET",
url: "/:certificateAuthorityId",
url: "/:caName",
config: {
rateLimit: readLimit
},
@@ -90,20 +91,25 @@ export const registerCertificateAuthorityEndpoints = <
hide: false,
tags: [ApiDocsTags.PkiCertificateAuthorities],
params: z.object({
certificateAuthorityId: z.string().uuid()
caName: z.string()
}),
querystring: z.object({
projectId: z.string().uuid()
}),
response: {
200: z.object({ certificateAuthority: responseSchema })
200: responseSchema
}
},
onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
handler: async (req) => {
const { certificateAuthorityId } = req.params;
const { caName } = req.params;
const { projectId } = req.query;
const certificateAuthority = (await server.services.certificateAuthority.findCertificateAuthorityById(
{ certificateAuthorityId, type: caType },
req.permission
)) as T;
const certificateAuthority =
(await server.services.certificateAuthority.findCertificateAuthorityByNameAndProjectId(
{ caName, type: caType, projectId },
req.permission
)) as T;
await server.services.auditLog.createAuditLog({
...req.auditLogInfo,
@@ -116,7 +122,7 @@ export const registerCertificateAuthorityEndpoints = <
}
});
return { certificateAuthority };
return certificateAuthority;
}
});
@@ -131,7 +137,7 @@ export const registerCertificateAuthorityEndpoints = <
tags: [ApiDocsTags.PkiCertificateAuthorities],
body: createSchema,
response: {
200: z.object({ certificateAuthority: responseSchema })
200: responseSchema
}
},
onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
@@ -152,13 +158,13 @@ export const registerCertificateAuthorityEndpoints = <
}
});
return { certificateAuthority };
return certificateAuthority;
}
});
server.route({
method: "PATCH",
url: "/:certificateAuthorityId",
url: "/:caName",
config: {
rateLimit: writeLimit
},
@@ -166,22 +172,22 @@ export const registerCertificateAuthorityEndpoints = <
hide: false,
tags: [ApiDocsTags.PkiCertificateAuthorities],
params: z.object({
certificateAuthorityId: z.string().uuid()
caName: z.string()
}),
body: updateSchema,
response: {
200: z.object({ certificateAuthority: responseSchema })
200: responseSchema
}
},
onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
handler: async (req) => {
const { certificateAuthorityId } = req.params;
const { caName } = req.params;
const certificateAuthority = (await server.services.certificateAuthority.updateCertificateAuthority(
{
...req.body,
id: certificateAuthorityId,
type: caType
type: caType,
caName
},
req.permission
)) as T;
@@ -198,13 +204,13 @@ export const registerCertificateAuthorityEndpoints = <
}
});
return { certificateAuthority };
return certificateAuthority;
}
});
server.route({
method: "DELETE",
url: "/:certificateAuthorityId",
url: "/:caName",
config: {
rateLimit: writeLimit
},
@@ -212,18 +218,22 @@ export const registerCertificateAuthorityEndpoints = <
hide: false,
tags: [ApiDocsTags.PkiCertificateAuthorities],
params: z.object({
certificateAuthorityId: z.string().uuid()
caName: z.string()
}),
body: z.object({
projectId: z.string().uuid()
}),
response: {
200: z.object({ certificateAuthority: responseSchema })
200: responseSchema
}
},
onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
handler: async (req) => {
const { certificateAuthorityId } = req.params;
const { caName } = req.params;
const { projectId } = req.body;
const certificateAuthority = (await server.services.certificateAuthority.deleteCertificateAuthority(
{ id: certificateAuthorityId, type: caType },
{ caName, type: caType, projectId },
req.permission
)) as T;
@@ -238,7 +248,7 @@ export const registerCertificateAuthorityEndpoints = <
}
});
return { certificateAuthority };
return certificateAuthority;
}
});
};

16
backend/src/server/routes/v1/pki-subscriber-router.ts
View File

@@ -485,30 +485,30 @@ export const registerPkiSubscriberRouter = async (server: FastifyZodProvider) =>
server.route({
method: "GET",
url: "/:subscriberName/active-certificate/bundle",
url: "/:subscriberName/latest-certificate-bundle",
config: {
rateLimit: readLimit
},
schema: {
hide: false,
tags: [ApiDocsTags.PkiSubscribers],
description: "Get active certificate bundle of a subscriber",
description: "Get latest certificate bundle of a subscriber",
params: z.object({
subscriberName: z.string().describe(PKI_SUBSCRIBERS.GET_ACTIVE_CERT_BUNDLE.subscriberName)
subscriberName: z.string().describe(PKI_SUBSCRIBERS.GET_LATEST_CERT_BUNDLE.subscriberName)
}),
querystring: z.object({
projectId: z.string().trim().describe(PKI_SUBSCRIBERS.GET_ACTIVE_CERT_BUNDLE.projectId)
projectId: z.string().trim().describe(PKI_SUBSCRIBERS.GET_LATEST_CERT_BUNDLE.projectId)
}),
response: {
200: z.object({
certificate: z.string().trim().describe(PKI_SUBSCRIBERS.GET_ACTIVE_CERT_BUNDLE.certificate),
certificate: z.string().trim().describe(PKI_SUBSCRIBERS.GET_LATEST_CERT_BUNDLE.certificate),
certificateChain: z
.string()
.trim()
.nullable()
.describe(PKI_SUBSCRIBERS.GET_ACTIVE_CERT_BUNDLE.certificateChain),
privateKey: z.string().trim().describe(PKI_SUBSCRIBERS.GET_ACTIVE_CERT_BUNDLE.privateKey),
serialNumber: z.string().trim().describe(PKI_SUBSCRIBERS.GET_ACTIVE_CERT_BUNDLE.serialNumber)
.describe(PKI_SUBSCRIBERS.GET_LATEST_CERT_BUNDLE.certificateChain),
privateKey: z.string().trim().describe(PKI_SUBSCRIBERS.GET_LATEST_CERT_BUNDLE.privateKey),
serialNumber: z.string().trim().describe(PKI_SUBSCRIBERS.GET_LATEST_CERT_BUNDLE.serialNumber)
})
}
},

47
backend/src/services/certificate-authority/acme/acme-certificate-authority-fns.ts
View File

@@ -77,8 +77,8 @@ export const castDbEntryToAcmeCertificateAuthority = (
return {
id: ca.id,
type: CaType.ACME,
disableDirectIssuance: ca.disableDirectIssuance,
name: ca.externalCa.name,
enableDirectIssuance: ca.enableDirectIssuance,
name: ca.name,
projectId: ca.projectId,
credentials: ca.externalCa.credentials,
configuration: {
@@ -90,7 +90,7 @@ export const castDbEntryToAcmeCertificateAuthority = (
directoryUrl: dbConfigurationCol.directoryUrl,
accountEmail: dbConfigurationCol.accountEmail
},
status: ca.externalCa.status as CaStatus
status: ca.status as CaStatus
};
};
@@ -176,7 +176,7 @@ export const AcmeCertificateAuthorityFns = ({
name,
projectId,
configuration,
disableDirectIssuance,
enableDirectIssuance,
actor,
status
}: {
@@ -184,7 +184,7 @@ export const AcmeCertificateAuthorityFns = ({
name: string;
projectId: string;
configuration: TCreateAcmeCertificateAuthorityDTO["configuration"];
disableDirectIssuance: boolean;
enableDirectIssuance: boolean;
actor: OrgServiceActor;
}) => {
const { dnsAppConnectionId, directoryUrl, accountEmail, dnsProviderConfig } = configuration;
@@ -208,25 +208,24 @@ export const AcmeCertificateAuthorityFns = ({
const ca = await certificateAuthorityDAL.create(
{
projectId,
disableDirectIssuance
enableDirectIssuance,
name,
status
},
tx
);
await externalCertificateAuthorityDAL.create(
{
certificateAuthorityId: ca.id,
caId: ca.id,
dnsAppConnectionId,
type: CaType.ACME,
name,
projectId,
configuration: {
directoryUrl,
accountEmail,
dnsProvider: dnsProviderConfig.provider,
hostedZoneId: dnsProviderConfig.hostedZoneId
},
status
}
},
tx
);
@@ -255,14 +254,14 @@ export const AcmeCertificateAuthorityFns = ({
id,
status,
configuration,
disableDirectIssuance,
enableDirectIssuance,
actor,
name
}: {
id: string;
status?: CaStatus;
configuration: TUpdateAcmeCertificateAuthorityDTO["configuration"];
disableDirectIssuance?: boolean;
enableDirectIssuance?: boolean;
actor: OrgServiceActor;
name?: string;
}) => {
@@ -290,7 +289,7 @@ export const AcmeCertificateAuthorityFns = ({
await externalCertificateAuthorityDAL.update(
{
certificateAuthorityId: id,
caId: id,
type: CaType.ACME
},
{
@@ -306,23 +305,13 @@ export const AcmeCertificateAuthorityFns = ({
);
}
await externalCertificateAuthorityDAL.update(
{
certificateAuthorityId: id,
type: CaType.ACME
},
{
name,
status
},
tx
);
if (disableDirectIssuance !== undefined) {
if (name || status || enableDirectIssuance) {
await certificateAuthorityDAL.updateById(
id,
{
disableDirectIssuance
name,
status,
enableDirectIssuance
},
tx
);
@@ -399,7 +388,7 @@ export const AcmeCertificateAuthorityFns = ({
});
await externalCertificateAuthorityDAL.update(
{
certificateAuthorityId: acmeCa.id
caId: acmeCa.id
},
{
credentials: encryptedNewCredentials

130
backend/src/services/certificate-authority/certificate-authority-dal.ts
View File

@@ -14,25 +14,25 @@ export type TCertificateAuthorityWithAssociatedCa = Awaited<
export const certificateAuthorityDALFactory = (db: TDbClient) => {
const caOrm = ormify(db, TableName.CertificateAuthority);
const findByIdWithAssociatedCa = async (caId: string, tx?: Knex) => {
const findByNameAndProjectIdWithAssociatedCa = async (caName: string, projectId: string, tx?: Knex) => {
const result = await (tx || db.replicaNode())(TableName.CertificateAuthority)
.leftJoin(
TableName.InternalCertificateAuthority,
`${TableName.CertificateAuthority}.id`,
`${TableName.InternalCertificateAuthority}.certificateAuthorityId`
`${TableName.InternalCertificateAuthority}.caId`
)
.leftJoin(
TableName.ExternalCertificateAuthority,
`${TableName.CertificateAuthority}.id`,
`${TableName.ExternalCertificateAuthority}.certificateAuthorityId`
`${TableName.ExternalCertificateAuthority}.caId`
)
.where(`${TableName.CertificateAuthority}.id`, caId)
.where(`${TableName.CertificateAuthority}.name`, caName)
.where(`${TableName.CertificateAuthority}.projectId`, projectId)
.select(selectAllTableCols(TableName.CertificateAuthority))
.select(
db.ref("id").withSchema(TableName.InternalCertificateAuthority).as("internalCaId"),
db.ref("parentCaId").withSchema(TableName.InternalCertificateAuthority).as("internalParentCaId"),
db.ref("type").withSchema(TableName.InternalCertificateAuthority).as("internalType"),
db.ref("status").withSchema(TableName.InternalCertificateAuthority).as("internalStatus"),
db.ref("friendlyName").withSchema(TableName.InternalCertificateAuthority).as("internalFriendlyName"),
db.ref("organization").withSchema(TableName.InternalCertificateAuthority).as("internalOrganization"),
db.ref("ou").withSchema(TableName.InternalCertificateAuthority).as("internalOu"),
@@ -46,17 +46,11 @@ export const certificateAuthorityDALFactory = (db: TDbClient) => {
db.ref("keyAlgorithm").withSchema(TableName.InternalCertificateAuthority).as("internalKeyAlgorithm"),
db.ref("notBefore").withSchema(TableName.InternalCertificateAuthority).as("internalNotBefore"),
db.ref("notAfter").withSchema(TableName.InternalCertificateAuthority).as("internalNotAfter"),
db.ref("activeCaCertId").withSchema(TableName.InternalCertificateAuthority).as("internalActiveCaCertId"),
db
.ref("certificateAuthorityId")
.withSchema(TableName.InternalCertificateAuthority)
.as("internalCertificateAuthorityId")
db.ref("activeCaCertId").withSchema(TableName.InternalCertificateAuthority).as("internalActiveCaCertId")
)
.select(
db.ref("id").withSchema(TableName.ExternalCertificateAuthority).as("externalCaId"),
db.ref("name").withSchema(TableName.ExternalCertificateAuthority).as("externalName"),
db.ref("type").withSchema(TableName.ExternalCertificateAuthority).as("externalType"),
db.ref("status").withSchema(TableName.ExternalCertificateAuthority).as("externalStatus"),
db.ref("configuration").withSchema(TableName.ExternalCertificateAuthority).as("externalConfiguration"),
db.ref("credentials").withSchema(TableName.ExternalCertificateAuthority).as("externalCredentials"),
db
@@ -74,7 +68,6 @@ export const certificateAuthorityDALFactory = (db: TDbClient) => {
id: result.internalCaId,
parentCaId: result.internalParentCaId,
type: result.internalType,
status: result.internalStatus,
friendlyName: result.internalFriendlyName,
organization: result.internalOrganization,
ou: result.internalOu,
@@ -88,16 +81,97 @@ export const certificateAuthorityDALFactory = (db: TDbClient) => {
keyAlgorithm: result.internalKeyAlgorithm,
notBefore: result.internalNotBefore?.toISOString(),
notAfter: result.internalNotAfter?.toISOString(),
activeCaCertId: result.internalActiveCaCertId,
certificateAuthorityId: result.internalCertificateAuthorityId
activeCaCertId: result.internalActiveCaCertId
}
: undefined,
externalCa: result
? {
id: result.externalCaId,
type: result.externalType,
configuration: result.externalConfiguration,
dnsAppConnectionId: result.externalDnsAppConnectionId,
appConnectionId: result.externalAppConnectionId,
credentials: result.externalCredentials
}
: undefined
};
return data;
};
const findByIdWithAssociatedCa = async (caId: string, tx?: Knex) => {
const result = await (tx || db.replicaNode())(TableName.CertificateAuthority)
.leftJoin(
TableName.InternalCertificateAuthority,
`${TableName.CertificateAuthority}.id`,
`${TableName.InternalCertificateAuthority}.caId`
)
.leftJoin(
TableName.ExternalCertificateAuthority,
`${TableName.CertificateAuthority}.id`,
`${TableName.ExternalCertificateAuthority}.caId`
)
.where(`${TableName.CertificateAuthority}.id`, caId)
.select(selectAllTableCols(TableName.CertificateAuthority))
.select(
db.ref("id").withSchema(TableName.InternalCertificateAuthority).as("internalCaId"),
db.ref("parentCaId").withSchema(TableName.InternalCertificateAuthority).as("internalParentCaId"),
db.ref("type").withSchema(TableName.InternalCertificateAuthority).as("internalType"),
db.ref("friendlyName").withSchema(TableName.InternalCertificateAuthority).as("internalFriendlyName"),
db.ref("organization").withSchema(TableName.InternalCertificateAuthority).as("internalOrganization"),
db.ref("ou").withSchema(TableName.InternalCertificateAuthority).as("internalOu"),
db.ref("country").withSchema(TableName.InternalCertificateAuthority).as("internalCountry"),
db.ref("province").withSchema(TableName.InternalCertificateAuthority).as("internalProvince"),
db.ref("locality").withSchema(TableName.InternalCertificateAuthority).as("internalLocality"),
db.ref("commonName").withSchema(TableName.InternalCertificateAuthority).as("internalCommonName"),
db.ref("dn").withSchema(TableName.InternalCertificateAuthority).as("internalDn"),
db.ref("serialNumber").withSchema(TableName.InternalCertificateAuthority).as("internalSerialNumber"),
db.ref("maxPathLength").withSchema(TableName.InternalCertificateAuthority).as("internalMaxPathLength"),
db.ref("keyAlgorithm").withSchema(TableName.InternalCertificateAuthority).as("internalKeyAlgorithm"),
db.ref("notBefore").withSchema(TableName.InternalCertificateAuthority).as("internalNotBefore"),
db.ref("notAfter").withSchema(TableName.InternalCertificateAuthority).as("internalNotAfter"),
db.ref("activeCaCertId").withSchema(TableName.InternalCertificateAuthority).as("internalActiveCaCertId")
)
.select(
db.ref("id").withSchema(TableName.ExternalCertificateAuthority).as("externalCaId"),
db.ref("type").withSchema(TableName.ExternalCertificateAuthority).as("externalType"),
db.ref("configuration").withSchema(TableName.ExternalCertificateAuthority).as("externalConfiguration"),
db.ref("credentials").withSchema(TableName.ExternalCertificateAuthority).as("externalCredentials"),
db
.ref("dnsAppConnectionId")
.withSchema(TableName.ExternalCertificateAuthority)
.as("externalDnsAppConnectionId"),
db.ref("appConnectionId").withSchema(TableName.ExternalCertificateAuthority).as("externalAppConnectionId")
)
.first();
const data = {
...CertificateAuthoritiesSchema.parse(result),
internalCa: result
? {
id: result.internalCaId,
parentCaId: result.internalParentCaId,
type: result.internalType,
friendlyName: result.internalFriendlyName,
organization: result.internalOrganization,
ou: result.internalOu,
country: result.internalCountry,
province: result.internalProvince,
locality: result.internalLocality,
commonName: result.internalCommonName,
dn: result.internalDn,
serialNumber: result.internalSerialNumber,
maxPathLength: result.internalMaxPathLength,
keyAlgorithm: result.internalKeyAlgorithm,
notBefore: result.internalNotBefore?.toISOString(),
notAfter: result.internalNotAfter?.toISOString(),
activeCaCertId: result.internalActiveCaCertId
}
: undefined,
externalCa: result
? {
id: result.externalCaId,
name: result.externalName,
type: result.externalType,
status: result.externalStatus,
configuration: result.externalConfiguration,
dnsAppConnectionId: result.externalDnsAppConnectionId,
appConnectionId: result.externalAppConnectionId,
@@ -153,12 +227,12 @@ export const certificateAuthorityDALFactory = (db: TDbClient) => {
.leftJoin(
TableName.InternalCertificateAuthority,
`${TableName.CertificateAuthority}.id`,
`${TableName.InternalCertificateAuthority}.certificateAuthorityId`
`${TableName.InternalCertificateAuthority}.caId`
)
.leftJoin(
TableName.ExternalCertificateAuthority,
`${TableName.CertificateAuthority}.id`,
`${TableName.ExternalCertificateAuthority}.certificateAuthorityId`
`${TableName.ExternalCertificateAuthority}.caId`
)
// eslint-disable-next-line @typescript-eslint/no-misused-promises
.where(buildFindFilter(filter))
@@ -167,7 +241,6 @@ export const certificateAuthorityDALFactory = (db: TDbClient) => {
db.ref("id").withSchema(TableName.InternalCertificateAuthority).as("internalCaId"),
db.ref("parentCaId").withSchema(TableName.InternalCertificateAuthority).as("internalParentCaId"),
db.ref("type").withSchema(TableName.InternalCertificateAuthority).as("internalType"),
db.ref("status").withSchema(TableName.InternalCertificateAuthority).as("internalStatus"),
db.ref("friendlyName").withSchema(TableName.InternalCertificateAuthority).as("internalFriendlyName"),
db.ref("organization").withSchema(TableName.InternalCertificateAuthority).as("internalOrganization"),
db.ref("ou").withSchema(TableName.InternalCertificateAuthority).as("internalOu"),
@@ -181,17 +254,11 @@ export const certificateAuthorityDALFactory = (db: TDbClient) => {
db.ref("keyAlgorithm").withSchema(TableName.InternalCertificateAuthority).as("internalKeyAlgorithm"),
db.ref("notBefore").withSchema(TableName.InternalCertificateAuthority).as("internalNotBefore"),
db.ref("notAfter").withSchema(TableName.InternalCertificateAuthority).as("internalNotAfter"),
db.ref("activeCaCertId").withSchema(TableName.InternalCertificateAuthority).as("internalActiveCaCertId"),
db
.ref("certificateAuthorityId")
.withSchema(TableName.InternalCertificateAuthority)
.as("internalCertificateAuthorityId")
db.ref("activeCaCertId").withSchema(TableName.InternalCertificateAuthority).as("internalActiveCaCertId")
)
.select(
db.ref("id").withSchema(TableName.ExternalCertificateAuthority).as("externalCaId"),
db.ref("name").withSchema(TableName.ExternalCertificateAuthority).as("externalName"),
db.ref("type").withSchema(TableName.ExternalCertificateAuthority).as("externalType"),
db.ref("status").withSchema(TableName.ExternalCertificateAuthority).as("externalStatus"),
db.ref("configuration").withSchema(TableName.ExternalCertificateAuthority).as("externalConfiguration"),
db
.ref("dnsAppConnectionId")
@@ -220,7 +287,6 @@ export const certificateAuthorityDALFactory = (db: TDbClient) => {
id: ca.internalCaId,
parentCaId: ca.internalParentCaId,
type: ca.internalType,
status: ca.internalStatus,
friendlyName: ca.internalFriendlyName,
organization: ca.internalOrganization,
ou: ca.internalOu,
@@ -234,16 +300,13 @@ export const certificateAuthorityDALFactory = (db: TDbClient) => {
keyAlgorithm: ca.internalKeyAlgorithm,
notBefore: ca.internalNotBefore?.toISOString(),
notAfter: ca.internalNotAfter?.toISOString(),
activeCaCertId: ca.internalActiveCaCertId,
certificateAuthorityId: ca.internalCertificateAuthorityId
activeCaCertId: ca.internalActiveCaCertId
}
: undefined,
externalCa: ca
? {
id: ca.externalCaId,
name: ca.externalName,
type: ca.externalType,
status: ca.externalStatus,
configuration: ca.externalConfiguration,
dnsAppConnectionId: ca.externalDnsAppConnectionId,
appConnectionId: ca.externalAppConnectionId,
@@ -260,6 +323,7 @@ export const certificateAuthorityDALFactory = (db: TDbClient) => {
...caOrm,
findWithAssociatedCa,
buildCertificateChain,
findByIdWithAssociatedCa
findByIdWithAssociatedCa,
findByNameAndProjectIdWithAssociatedCa
};
};

2
backend/src/services/certificate-authority/certificate-authority-fns.ts
View File

@@ -329,6 +329,6 @@ export const expandInternalCa = (
return {
...ca.internalCa,
...ca,
requireTemplateForIssuance: ca.disableDirectIssuance
requireTemplateForIssuance: !ca.enableDirectIssuance
} as const;
};

9
backend/src/services/certificate-authority/certificate-authority-schemas.ts
View File

@@ -8,10 +8,10 @@ import { CaStatus, CaType } from "./certificate-authority-enums";
export const BaseCertificateAuthoritySchema = CertificateAuthoritiesSchema.pick({
projectId: true,
disableDirectIssuance: true,
enableDirectIssuance: true,
name: true,
id: true
}).extend({
name: z.string(),
status: z.nativeEnum(CaStatus)
});
@@ -19,13 +19,14 @@ export const GenericCreateCertificateAuthorityFieldsSchema = (type: CaType) =>
z.object({
name: slugSchema({ field: "name" }).describe(CertificateAuthorities.CREATE(type).name),
projectId: z.string().trim().min(1, "Project ID required").describe(CertificateAuthorities.CREATE(type).projectId),
disableDirectIssuance: z.boolean().describe(CertificateAuthorities.CREATE(type).disableDirectIssuance),
enableDirectIssuance: z.boolean().describe(CertificateAuthorities.CREATE(type).enableDirectIssuance),
status: z.nativeEnum(CaStatus).describe(CertificateAuthorities.CREATE(type).status)
});
export const GenericUpdateCertificateAuthorityFieldsSchema = (type: CaType) =>
z.object({
name: slugSchema({ field: "name" }).optional().describe(CertificateAuthorities.UPDATE(type).name),
disableDirectIssuance: z.boolean().optional().describe(CertificateAuthorities.UPDATE(type).disableDirectIssuance),
projectId: z.string().trim().min(1, "Project ID required").describe(CertificateAuthorities.UPDATE(type).projectId),
enableDirectIssuance: z.boolean().optional().describe(CertificateAuthorities.UPDATE(type).enableDirectIssuance),
status: z.nativeEnum(CaStatus).optional().describe(CertificateAuthorities.UPDATE(type).status)
});

86
backend/src/services/certificate-authority/certificate-authority-service.ts
View File

@@ -46,6 +46,7 @@ type TCertificateAuthorityServiceFactoryDep = {
| "findOne"
| "findByIdWithAssociatedCa"
| "findWithAssociatedCa"
| "findByNameAndProjectIdWithAssociatedCa"
>;
externalCertificateAuthorityDAL: Pick<TExternalCertificateAuthorityDALFactory, "create" | "update">;
internalCertificateAuthorityService: TInternalCertificateAuthorityServiceFactory;
@@ -94,7 +95,7 @@ export const certificateAuthorityServiceFactory = ({
});
const createCertificateAuthority = async (
{ type, projectId, name, disableDirectIssuance, configuration, status }: TCreateCertificateAuthorityDTO,
{ type, projectId, name, enableDirectIssuance, configuration, status }: TCreateCertificateAuthorityDTO,
actor: OrgServiceActor
) => {
let finalProjectId: string = projectId;
@@ -126,7 +127,7 @@ export const certificateAuthorityServiceFactory = ({
...(configuration as TCreateInternalCertificateAuthorityDTO["configuration"]),
isInternal: true,
projectId: finalProjectId,
requireTemplateForIssuance: disableDirectIssuance
requireTemplateForIssuance: !enableDirectIssuance
});
if (!ca.internalCa) {
@@ -138,8 +139,8 @@ export const certificateAuthorityServiceFactory = ({
return {
id: ca.id,
type,
disableDirectIssuance: ca.disableDirectIssuance,
name: ca.internalCa?.friendlyName,
enableDirectIssuance: ca.enableDirectIssuance,
name: ca.name,
projectId: finalProjectId,
status,
configuration: ca.internalCa
@@ -151,7 +152,7 @@ export const certificateAuthorityServiceFactory = ({
name,
projectId: finalProjectId,
configuration: configuration as TCreateAcmeCertificateAuthorityDTO["configuration"],
disableDirectIssuance,
enableDirectIssuance,
status,
actor
});
@@ -160,15 +161,18 @@ export const certificateAuthorityServiceFactory = ({
throw new BadRequestError({ message: "Invalid certificate authority type" });
};
const findCertificateAuthorityById = async (
{ certificateAuthorityId, type }: { certificateAuthorityId: string; type: CaType },
const findCertificateAuthorityByNameAndProjectId = async (
{ caName, type, projectId }: { caName: string; type: CaType; projectId: string },
actor: OrgServiceActor
) => {
const certificateAuthority = await certificateAuthorityDAL.findByIdWithAssociatedCa(certificateAuthorityId);
const certificateAuthority = await certificateAuthorityDAL.findByNameAndProjectIdWithAssociatedCa(
caName,
projectId
);
if (!certificateAuthority)
throw new NotFoundError({
message: `Could not find certificate authority with ID "${certificateAuthorityId}"`
message: `Could not find certificate authority with name "${caName}" in project "${projectId}"`
});
const { permission } = await permissionService.getProjectPermission({
@@ -188,24 +192,24 @@ export const certificateAuthorityServiceFactory = ({
if (type === CaType.INTERNAL) {
if (!certificateAuthority.internalCa?.id) {
throw new NotFoundError({
message: `Internal certificate authority with ID "${certificateAuthorityId}" not found`
message: `Internal certificate authority with name "${caName}" in project "${projectId}" not found`
});
}
return {
id: certificateAuthority.id,
type,
disableDirectIssuance: certificateAuthority.disableDirectIssuance,
name: certificateAuthority.internalCa.friendlyName,
enableDirectIssuance: certificateAuthority.enableDirectIssuance,
name: certificateAuthority.name,
projectId: certificateAuthority.projectId,
configuration: certificateAuthority.internalCa,
status: certificateAuthority.internalCa.status
status: certificateAuthority.status
} as TCertificateAuthority;
}
if (certificateAuthority.externalCa?.type !== type) {
throw new NotFoundError({
message: `Could not find external certificate authority with ID "${certificateAuthorityId}" and type "${type}"`
message: `Could not find external certificate authority with name "${caName}" in project "${projectId}" and type "${type}"`
});
}
@@ -255,11 +259,11 @@ export const certificateAuthorityServiceFactory = ({
.map((ca) => ({
id: ca.id,
type,
disableDirectIssuance: ca.disableDirectIssuance,
name: ca.internalCa.friendlyName,
enableDirectIssuance: ca.enableDirectIssuance,
name: ca.name,
projectId: ca.projectId,
configuration: ca.internalCa,
status: ca.internalCa.status
status: ca.status
})) as TCertificateAuthority[];
}
@@ -271,14 +275,17 @@ export const certificateAuthorityServiceFactory = ({
};
const updateCertificateAuthority = async (
{ id, type, configuration, disableDirectIssuance, status, name }: TUpdateCertificateAuthorityDTO,
{ caName, type, configuration, enableDirectIssuance, status, name, projectId }: TUpdateCertificateAuthorityDTO,
actor: OrgServiceActor
) => {
const certificateAuthority = await certificateAuthorityDAL.findByIdWithAssociatedCa(id);
const certificateAuthority = await certificateAuthorityDAL.findByNameAndProjectIdWithAssociatedCa(
caName,
projectId
);
if (!certificateAuthority)
throw new NotFoundError({
message: `Could not find certificate authority with ID "${id}"`
message: `Could not find certificate authority with name "${caName}" in project "${projectId}"`
});
const { permission } = await permissionService.getProjectPermission({
@@ -298,15 +305,16 @@ export const certificateAuthorityServiceFactory = ({
if (type === CaType.INTERNAL) {
if (!certificateAuthority.internalCa?.id) {
throw new NotFoundError({
message: `Internal certificate authority with ID "${id}" not found`
message: `Internal certificate authority with name "${caName}" in project "${projectId}" not found`
});
}
const updatedCa = await internalCertificateAuthorityService.updateCaById({
...configuration,
isInternal: true,
requireTemplateForIssuance: disableDirectIssuance,
caId: id
requireTemplateForIssuance: !enableDirectIssuance,
caId: certificateAuthority.id,
name
});
if (!updatedCa.internalCa) {
@@ -318,19 +326,19 @@ export const certificateAuthorityServiceFactory = ({
return {
id: updatedCa.id,
type,
disableDirectIssuance: updatedCa.disableDirectIssuance,
name: updatedCa.internalCa?.friendlyName,
enableDirectIssuance: updatedCa.enableDirectIssuance,
name: updatedCa.name,
projectId: updatedCa.projectId,
configuration: updatedCa.internalCa,
status: updatedCa.internalCa?.status
status: updatedCa.status
} as TCertificateAuthority;
}
if (type === CaType.ACME) {
return acmeFns.updateCertificateAuthority({
id,
id: certificateAuthority.id,
configuration: configuration as TUpdateAcmeCertificateAuthorityDTO["configuration"],
disableDirectIssuance,
enableDirectIssuance,
actor,
status,
name
@@ -340,12 +348,18 @@ export const certificateAuthorityServiceFactory = ({
throw new BadRequestError({ message: "Invalid certificate authority type" });
};
const deleteCertificateAuthority = async ({ id, type }: { id: string; type: CaType }, actor: OrgServiceActor) => {
const certificateAuthority = await certificateAuthorityDAL.findByIdWithAssociatedCa(id);
const deleteCertificateAuthority = async (
{ caName, type, projectId }: { caName: string; type: CaType; projectId: string },
actor: OrgServiceActor
) => {
const certificateAuthority = await certificateAuthorityDAL.findByNameAndProjectIdWithAssociatedCa(
caName,
projectId
);
if (!certificateAuthority)
throw new NotFoundError({
message: `Could not find certificate authority with ID "${id}"`
message: `Could not find certificate authority with name "${caName}" in project "${projectId}"`
});
const { permission } = await permissionService.getProjectPermission({
@@ -374,17 +388,17 @@ export const certificateAuthorityServiceFactory = ({
});
}
await certificateAuthorityDAL.deleteById(id);
await certificateAuthorityDAL.deleteById(certificateAuthority.id);
if (type === CaType.INTERNAL) {
return {
id: certificateAuthority.id,
type,
disableDirectIssuance: certificateAuthority.disableDirectIssuance,
name: certificateAuthority.internalCa?.friendlyName,
enableDirectIssuance: certificateAuthority.enableDirectIssuance,
name: certificateAuthority.name,
projectId: certificateAuthority.projectId,
configuration: certificateAuthority.internalCa,
status: certificateAuthority.internalCa?.status
status: certificateAuthority.status
} as TCertificateAuthority;
}
@@ -397,7 +411,7 @@ export const certificateAuthorityServiceFactory = ({
return {
createCertificateAuthority,
findCertificateAuthorityById,
findCertificateAuthorityByNameAndProjectId,
listCertificateAuthoritiesByProjectId,
updateCertificateAuthority,
deleteCertificateAuthority

3
backend/src/services/certificate-authority/certificate-authority-types.ts
View File

@@ -13,5 +13,6 @@ export type TCreateCertificateAuthorityDTO = Omit<TCertificateAuthority, "id">;
export type TUpdateCertificateAuthorityDTO = Partial<Omit<TCreateCertificateAuthorityDTO, "projectId">> & {
type: CaType;
id: string;
caName: string;
projectId: string;
};

48
backend/src/services/certificate-authority/internal/internal-certificate-authority-service.ts
View File

@@ -1,6 +1,7 @@
/* eslint-disable no-bitwise */
import { ForbiddenError } from "@casl/ability";
import * as x509 from "@peculiar/x509";
import slugify from "@sindresorhus/slugify";
import crypto, { KeyObject } from "crypto";
import { z } from "zod";
@@ -21,6 +22,7 @@ import { extractX509CertFromChain } from "@app/lib/certificates/extract-certific
import { getConfig } from "@app/lib/config/env";
import { BadRequestError, NotFoundError } from "@app/lib/errors";
import { ms } from "@app/lib/ms";
import { alphaNumericNanoId } from "@app/lib/nanoid";
import { isFQDN } from "@app/lib/validator/validate-url";
import { TCertificateBodyDALFactory } from "@app/services/certificate/certificate-body-dal";
import { TCertificateDALFactory } from "@app/services/certificate/certificate-dal";
@@ -200,14 +202,16 @@ export const internalCertificateAuthorityServiceFactory = ({
const ca = await certificateAuthorityDAL.create(
{
projectId,
disableDirectIssuance: requireTemplateForIssuance
enableDirectIssuance: !requireTemplateForIssuance,
name: slugify(`${friendlyName || dn}-${alphaNumericNanoId(8)}`),
status: type === InternalCaType.ROOT ? CaStatus.ACTIVE : CaStatus.PENDING_CERTIFICATE
},
tx
);
const internalCa = await internalCertificateAuthorityDAL.create(
{
certificateAuthorityId: ca.id,
caId: ca.id,
type,
organization,
ou,
@@ -216,7 +220,6 @@ export const internalCertificateAuthorityServiceFactory = ({
locality,
friendlyName: friendlyName || dn,
commonName,
status: type === InternalCaType.ROOT ? CaStatus.ACTIVE : CaStatus.PENDING_CERTIFICATE,
dn,
keyAlgorithm,
...(type === InternalCaType.ROOT && {
@@ -357,7 +360,7 @@ export const internalCertificateAuthorityServiceFactory = ({
* Update CA with id [caId].
* Note: Used to enable/disable CA
*/
const updateCaById = async ({ caId, status, requireTemplateForIssuance, ...dto }: TUpdateCaDTO) => {
const updateCaById = async ({ caId, status, requireTemplateForIssuance, name, ...dto }: TUpdateCaDTO) => {
const ca = await certificateAuthorityDAL.findByIdWithAssociatedCa(caId);
if (!ca.internalCa) throw new NotFoundError({ message: `CA with ID '${caId}' not found` });
@@ -378,20 +381,14 @@ export const internalCertificateAuthorityServiceFactory = ({
}
const updatedCa = await certificateAuthorityDAL.transaction(async (tx) => {
if (status !== undefined) {
await internalCertificateAuthorityDAL.update(
{
certificateAuthorityId: ca.id
},
{ status },
if (requireTemplateForIssuance !== undefined || status !== undefined || name !== undefined) {
await certificateAuthorityDAL.updateById(
ca.id,
{ enableDirectIssuance: !requireTemplateForIssuance, status, name },
tx
);
}
if (requireTemplateForIssuance !== undefined) {
await certificateAuthorityDAL.updateById(ca.id, { disableDirectIssuance: requireTemplateForIssuance }, tx);
}
return certificateAuthorityDAL.findByIdWithAssociatedCa(caId, tx);
});
@@ -509,7 +506,7 @@ export const internalCertificateAuthorityServiceFactory = ({
ProjectPermissionSub.CertificateAuthorities
);
if (ca.internalCa.status === CaStatus.DISABLED) throw new BadRequestError({ message: "CA is disabled" });
if (ca.status === CaStatus.DISABLED) throw new BadRequestError({ message: "CA is disabled" });
// get latest CA certificate
const caCert = await certificateAuthorityCertDAL.findById(ca.internalCa.activeCaCertId);
@@ -604,7 +601,7 @@ export const internalCertificateAuthorityServiceFactory = ({
await internalCertificateAuthorityDAL.update(
{
certificateAuthorityId: ca.id
caId: ca.id
},
{
activeCaCertId: newCaCert.id,
@@ -746,7 +743,7 @@ export const internalCertificateAuthorityServiceFactory = ({
await internalCertificateAuthorityDAL.update(
{
certificateAuthorityId: ca.id
caId: ca.id
},
{
activeCaCertId: newCaCert.id,
@@ -914,7 +911,7 @@ export const internalCertificateAuthorityServiceFactory = ({
ProjectPermissionSub.CertificateAuthorities
);
if (ca.internalCa.status === CaStatus.DISABLED) throw new BadRequestError({ message: "CA is disabled" });
if (ca.status === CaStatus.DISABLED) throw new BadRequestError({ message: "CA is disabled" });
if (!ca.internalCa.activeCaCertId)
throw new BadRequestError({ message: "CA does not have a certificate installed" });
@@ -1150,12 +1147,15 @@ export const internalCertificateAuthorityServiceFactory = ({
tx
);
await certificateAuthorityDAL.updateById(ca.id, {
status: CaStatus.ACTIVE
});
await internalCertificateAuthorityDAL.update(
{
certificateAuthorityId: ca.id
caId: ca.id
},
{
status: CaStatus.ACTIVE,
maxPathLength: maxPathLength === undefined ? -1 : maxPathLength,
notBefore: new Date(certObj.notBefore),
notAfter: new Date(certObj.notAfter),
@@ -1231,10 +1231,10 @@ export const internalCertificateAuthorityServiceFactory = ({
ProjectPermissionSub.Certificates
);
if (ca.internalCa.status !== CaStatus.ACTIVE) throw new BadRequestError({ message: "CA is not active" });
if (ca.status !== CaStatus.ACTIVE) throw new BadRequestError({ message: "CA is not active" });
if (!ca.internalCa.activeCaCertId)
throw new BadRequestError({ message: "CA does not have a certificate installed" });
if (ca.disableDirectIssuance && !certificateTemplate) {
if (!ca.enableDirectIssuance && !certificateTemplate) {
throw new BadRequestError({ message: "Certificate template or subscriber is required for issuance" });
}
@@ -1589,10 +1589,10 @@ export const internalCertificateAuthorityServiceFactory = ({
);
}
if (ca.internalCa.status !== CaStatus.ACTIVE) throw new BadRequestError({ message: "CA is not active" });
if (ca.status !== CaStatus.ACTIVE) throw new BadRequestError({ message: "CA is not active" });
if (!ca.internalCa.activeCaCertId)
throw new BadRequestError({ message: "CA does not have a certificate installed" });
if (ca.disableDirectIssuance && !certificateTemplate) {
if (!ca.enableDirectIssuance && !certificateTemplate) {
throw new BadRequestError({ message: "Certificate template or subscriber is required for issuance" });
}

2
backend/src/services/certificate-authority/internal/internal-certificate-authority-types.ts
View File

@@ -69,12 +69,14 @@ export type TUpdateCaDTO =
| {
isInternal: true;
caId: string;
name?: string;
status?: CaStatus;
requireTemplateForIssuance?: boolean;
}
| ({
isInternal: false;
caId: string;
name?: string;
status?: CaStatus;
requireTemplateForIssuance?: boolean;
} & Omit<TProjectPermission, "projectId">);

4
backend/src/services/certificate-template/certificate-template-dal.ts
View File

@@ -21,7 +21,7 @@ export const certificateTemplateDALFactory = (db: TDbClient) => {
)
.join(
TableName.InternalCertificateAuthority,
`${TableName.InternalCertificateAuthority}.certificateAuthorityId`,
`${TableName.InternalCertificateAuthority}.caId`,
`${TableName.CertificateAuthority}.id`
)
.where(`${TableName.CertificateAuthority}.projectId`, "=", projectId)
@@ -48,7 +48,7 @@ export const certificateTemplateDALFactory = (db: TDbClient) => {
.join(TableName.Project, `${TableName.Project}.id`, `${TableName.CertificateAuthority}.projectId`)
.join(
TableName.InternalCertificateAuthority,
`${TableName.InternalCertificateAuthority}.certificateAuthorityId`,
`${TableName.InternalCertificateAuthority}.caId`,
`${TableName.CertificateAuthority}.id`
)
.where(`${TableName.CertificateTemplate}.id`, "=", id)

2
backend/src/services/pki-alert/pki-alert-dal.ts
View File

@@ -37,7 +37,7 @@ export const pkiAlertDALFactory = (db: TDbClient) => {
"pci.pkiCollectionId"
)
.from(`${TableName.CertificateAuthority} as ${PkiItemType.CA}`)
.join(`${TableName.InternalCertificateAuthority} as ic`, `${PkiItemType.CA}.id`, "ic.certificateAuthorityId")
.join(`${TableName.InternalCertificateAuthority} as ic`, `${PkiItemType.CA}.id`, "ic.caId")
.join(`${TableName.PkiCollectionItem} as pci`, `${PkiItemType.CA}.id`, "pci.caId")
.unionAll((qb) => {
void qb

2
backend/src/services/pki-collection/pki-collection-item-dal.ts
View File

@@ -44,7 +44,7 @@ export const pkiCollectionItemDALFactory = (db: TDbClient) => {
.leftJoin(
TableName.InternalCertificateAuthority,
`${TableName.PkiCollectionItem}.caId`,
`${TableName.InternalCertificateAuthority}.certificateAuthorityId`
`${TableName.InternalCertificateAuthority}.caId`
)
.leftJoin(TableName.Certificate, `${TableName.PkiCollectionItem}.certId`, `${TableName.Certificate}.id`)
.where((builder) => {

2
docs/api-reference/endpoints/certificate-authorities/acme/delete.mdx
View File

@@ -1,4 +1,4 @@
---
title: "Delete"
openapi: "DELETE /api/v1/pki/ca/acme/{certificateAuthorityId}"
openapi: "DELETE /api/v1/pki/ca/acme/{caName}"
---

2
docs/api-reference/endpoints/certificate-authorities/acme/read.mdx
View File

@@ -1,4 +1,4 @@
---
title: "Read"
openapi: "GET /api/v1/pki/ca/acme/{certificateAuthorityId}"
openapi: "GET /api/v1/pki/ca/acme/{caName}"
---

2
docs/api-reference/endpoints/certificate-authorities/acme/update.mdx
View File

@@ -1,4 +1,4 @@
---
title: "Update"
openapi: "PATCH /api/v1/pki/ca/acme/{certificateAuthorityId}"
openapi: "PATCH /api/v1/pki/ca/acme/{caName}"
---

4
docs/api-reference/endpoints/pki/subscribers/get-active-cert-bundle.mdx
View File

@@ -1,4 +0,0 @@
---
title: "Retrieve active certificate bundle"
openapi: "GET /api/v1/pki/subscribers/{subscriberName}/active-certificate/bundle"
---

4
docs/api-reference/endpoints/pki/subscribers/get-latest-cert-bundle.mdx Normal file
View File

@@ -0,0 +1,4 @@
---
title: "Retrieve latest certificate bundle"
openapi: "GET /api/v1/pki/subscribers/{subscriberName}/latest-certificate-bundle"
---

2
docs/mint.json
View File

@@ -1522,7 +1522,7 @@
"api-reference/endpoints/pki/subscribers/issue-cert",
"api-reference/endpoints/pki/subscribers/sign-cert",
"api-reference/endpoints/pki/subscribers/order-cert",
"api-reference/endpoints/pki/subscribers/get-active-cert-bundle"
"api-reference/endpoints/pki/subscribers/get-latest-cert-bundle"
]
},
{

2
frontend/src/hooks/api/ca/index.tsx
View File

@@ -12,8 +12,8 @@ export {
useUpdateUnifiedCa
} from "./mutations";
export {
useGetCa,
useGetCaById,
useGetCaByTypeAndId,
useGetCaCert,
useGetCaCerts,
useGetCaCertTemplates,

19
frontend/src/hooks/api/ca/mutations.tsx
View File

@@ -26,15 +26,13 @@ import {
export const useUpdateUnifiedCa = () => {
const queryClient = useQueryClient();
return useMutation<TUnifiedCertificateAuthority, object, TUpdateUnifiedCertificateAuthorityDTO>({
mutationFn: async ({ id, ...body }) => {
const {
data: { certificateAuthority }
} = await apiRequest.patch<{ certificateAuthority: TUnifiedCertificateAuthority }>(
`/api/v1/pki/ca/${body.type}/${id}`,
mutationFn: async ({ caName, ...body }) => {
const { data } = await apiRequest.patch<TUnifiedCertificateAuthority>(
`/api/v1/pki/ca/${body.type}/${caName}`,
body
);
return certificateAuthority;
return data;
},
onSuccess: ({ projectId, type }) => {
queryClient.invalidateQueries({
@@ -65,11 +63,16 @@ export const useCreateUnifiedCa = () => {
export const useDeleteUnifiedCa = () => {
const queryClient = useQueryClient();
return useMutation<TUnifiedCertificateAuthority, object, TDeleteUnifiedCertificateAuthorityDTO>({
mutationFn: async ({ caId, type }) => {
mutationFn: async ({ caName, type, projectId }) => {
const {
data: { certificateAuthority }
} = await apiRequest.delete<{ certificateAuthority: TUnifiedCertificateAuthority }>(
`/api/v1/pki/ca/${type}/${caId}`
`/api/v1/pki/ca/${type}/${caName}`,
{
data: {
projectId
}
}
);
return certificateAuthority;
},

32
frontend/src/hooks/api/ca/queries.tsx
View File

@@ -8,7 +8,7 @@ import { TCertificateAuthority, TUnifiedCertificateAuthority } from "./types";
export const caKeys = {
getCaById: (caId: string) => [{ caId }, "ca"],
getCaByTypeAndId: (type: CaType, caId: string) => [{ type, caId }, "ca"],
getCaByNameAndProjectId: (caName: string, projectId: string) => [{ caName, projectId }, "ca"],
listCasByTypeAndProjectId: (type: CaType, projectId: string) => [{ type, projectId }, "cas"],
listCasByProjectId: (projectId: string) => [{ projectId }, "cas"],
getCaCerts: (caId: string) => [{ caId }, "ca-cert"],
@@ -20,18 +20,24 @@ export const caKeys = {
getCaEstConfig: (caId: string) => [{ caId }, "ca-est-config"]
};
export const useGetCaByTypeAndId = (type: CaType, caId: string) => {
export const useGetCa = ({
caName,
projectId,
type
}: {
caName: string;
projectId: string;
type: CaType;
}) => {
return useQuery({
queryKey: caKeys.getCaByTypeAndId(type, caId),
queryKey: caKeys.getCaByNameAndProjectId(caName, projectId),
queryFn: async () => {
const {
data: { certificateAuthority }
} = await apiRequest.get<{ certificateAuthority: TUnifiedCertificateAuthority }>(
`/api/v1/pki/ca/${type}/${caId}`
const { data } = await apiRequest.get<TUnifiedCertificateAuthority>(
`/api/v1/pki/ca/${type}/${caName}?projectId=${projectId}`
);
return certificateAuthority;
return data;
},
enabled: Boolean(caId)
enabled: Boolean(caName && projectId && type)
});
};
@@ -39,11 +45,11 @@ export const useListCasByTypeAndProjectId = (type: CaType, projectId: string) =>
return useQuery({
queryKey: caKeys.listCasByTypeAndProjectId(type, projectId),
queryFn: async () => {
const { data } = await apiRequest.get<{
certificateAuthorities: TUnifiedCertificateAuthority[];
}>(`/api/v1/pki/ca/${type}?projectId=${projectId}`);
const { data } = await apiRequest.get<TUnifiedCertificateAuthority[]>(
`/api/v1/pki/ca/${type}?projectId=${projectId}`
);
return data.certificateAuthorities;
return data;
}
});
};

9
frontend/src/hooks/api/ca/types.ts
View File

@@ -7,7 +7,7 @@ export type TAcmeCertificateAuthority = {
type: CaType.ACME;
status: CaStatus;
name: string;
disableDirectIssuance: boolean;
enableDirectIssuance: boolean;
configuration: {
dnsAppConnectionId: string;
dnsProviderConfig: {
@@ -25,7 +25,7 @@ export type TInternalCertificateAuthority = {
type: CaType.INTERNAL;
status: CaStatus;
name: string;
disableDirectIssuance: boolean;
enableDirectIssuance: boolean;
configuration: {
type: InternalCaType;
friendlyName?: string;
@@ -52,12 +52,13 @@ export type TUnifiedCertificateAuthority =
export type TCreateUnifiedCertificateAuthorityDTO = Omit<TUnifiedCertificateAuthority, "id">;
export type TUpdateUnifiedCertificateAuthorityDTO = Partial<TUnifiedCertificateAuthority> & {
id: string;
caName: string;
projectId: string;
type: CaType;
};
export type TDeleteUnifiedCertificateAuthorityDTO = {
caId: string;
caName: string;
type: CaType;
projectId: string;
};

31
frontend/src/pages/cert-manager/CertificateAuthoritiesPage/components/ExternalCaModal.tsx
View File

@@ -23,7 +23,7 @@ import {
CaStatus,
CaType,
useCreateUnifiedCa,
useGetCaByTypeAndId,
useGetCa,
useUpdateUnifiedCa
} from "@app/hooks/api/ca";
import { UsePopUpState } from "@app/hooks/usePopUp";
@@ -35,7 +35,7 @@ const schema = z
name: slugSchema({
field: "Name"
}),
disableDirectIssuance: z.boolean(),
enableDirectIssuance: z.boolean(),
status: z.nativeEnum(CaStatus),
configuration: z.object({
dnsAppConnection: z.object({
@@ -65,10 +65,11 @@ const caTypes = [{ label: "ACME", value: CaType.ACME }];
export const ExternalCaModal = ({ popUp, handlePopUpToggle }: Props) => {
const { currentWorkspace } = useWorkspace();
const { data: ca } = useGetCaByTypeAndId(
(popUp?.ca?.data as { type: CaType })?.type || "",
(popUp?.ca?.data as { caId: string })?.caId || ""
);
const { data: ca } = useGetCa({
caName: (popUp?.ca?.data as { name: string })?.name || "",
projectId: currentWorkspace?.id || "",
type: (popUp?.ca?.data as { type: CaType })?.type || ""
});
const { mutateAsync: createMutateAsync } = useCreateUnifiedCa();
const { mutateAsync: updateMutateAsync } = useUpdateUnifiedCa();
@@ -85,7 +86,7 @@ export const ExternalCaModal = ({ popUp, handlePopUpToggle }: Props) => {
type: CaType.ACME,
name: "",
status: CaStatus.ACTIVE,
disableDirectIssuance: false,
enableDirectIssuance: true,
configuration: {
dnsAppConnection: {
id: "",
@@ -122,7 +123,7 @@ export const ExternalCaModal = ({ popUp, handlePopUpToggle }: Props) => {
type: ca.type,
name: ca.name,
status: ca.status,
disableDirectIssuance: ca.disableDirectIssuance,
enableDirectIssuance: ca.enableDirectIssuance,
configuration: {
dnsAppConnection: {
id: ca.configuration.dnsAppConnectionId,
@@ -142,7 +143,7 @@ export const ExternalCaModal = ({ popUp, handlePopUpToggle }: Props) => {
type: CaType.ACME,
name: "",
status: CaStatus.ACTIVE,
disableDirectIssuance: false,
enableDirectIssuance: true,
configuration: {
dnsAppConnection: {
id: "",
@@ -162,7 +163,7 @@ export const ExternalCaModal = ({ popUp, handlePopUpToggle }: Props) => {
const onFormSubmit = async ({
type,
name,
disableDirectIssuance,
enableDirectIssuance,
status,
configuration
}: FormData) => {
@@ -171,12 +172,12 @@ export const ExternalCaModal = ({ popUp, handlePopUpToggle }: Props) => {
if (ca && type !== CaType.INTERNAL) {
await updateMutateAsync({
id: ca.id,
caName: ca.name,
projectId: currentWorkspace.id,
name,
type,
status,
disableDirectIssuance,
enableDirectIssuance,
configuration: {
...configuration,
dnsAppConnectionId: configuration.dnsAppConnection.id
@@ -188,7 +189,7 @@ export const ExternalCaModal = ({ popUp, handlePopUpToggle }: Props) => {
name,
type,
status,
disableDirectIssuance,
enableDirectIssuance,
configuration: {
...configuration,
dnsAppConnectionId: configuration.dnsAppConnection.id
@@ -369,7 +370,7 @@ export const ExternalCaModal = ({ popUp, handlePopUpToggle }: Props) => {
)}
<Controller
control={control}
name="disableDirectIssuance"
name="enableDirectIssuance"
render={({ field, fieldState: { error } }) => {
return (
<FormControl isError={Boolean(error)} errorText={error?.message} className="my-8">
@@ -378,7 +379,7 @@ export const ExternalCaModal = ({ popUp, handlePopUpToggle }: Props) => {
onCheckedChange={(value) => field.onChange(value)}
isChecked={field.value}
>
<p className="w-full">Disable Direct Issuance</p>
<p className="w-full">Enable Direct Issuance</p>
</Switch>
</FormControl>
);

14
frontend/src/pages/cert-manager/CertificateAuthoritiesPage/components/ExternalCaSection.tsx
View File

@@ -24,11 +24,11 @@ export const ExternalCaSection = () => {
"upgradePlan"
] as const);
const onRemoveCaSubmit = async (caId: string, type: CaType) => {
const onRemoveCaSubmit = async (caName: string, type: CaType) => {
try {
if (!currentWorkspace?.id) return;
await deleteCa({ caId, type, projectId: currentWorkspace.id });
await deleteCa({ caName, type, projectId: currentWorkspace.id });
createNotification({
text: "Successfully deleted CA",
@@ -45,18 +45,18 @@ export const ExternalCaSection = () => {
};
const onUpdateCaStatus = async ({
caId,
name,
type,
status
}: {
caId: string;
name: string;
type: CaType;
status: CaStatus;
}) => {
try {
if (!currentWorkspace?.slug) return;
await updateCa({ id: caId, type, status });
await updateCa({ caName: name, type, status, projectId: currentWorkspace.id });
createNotification({
text: `Successfully ${status === CaStatus.ACTIVE ? "enabled" : "disabled"} CA`,
@@ -105,7 +105,7 @@ export const ExternalCaSection = () => {
deleteKey="confirm"
onDeleteApproved={() =>
onRemoveCaSubmit(
(popUp?.deleteCa?.data as { caId: string })?.caId,
(popUp?.deleteCa?.data as { name: string })?.name,
(popUp?.deleteCa?.data as { type: CaType })?.type
)
}
@@ -127,7 +127,7 @@ export const ExternalCaSection = () => {
deleteKey="confirm"
onDeleteApproved={() =>
onUpdateCaStatus(
popUp?.caStatus?.data as { caId: string; type: CaType; status: CaStatus }
popUp?.caStatus?.data as { name: string; type: CaType; status: CaStatus }
)
}
/>

10
frontend/src/pages/cert-manager/CertificateAuthoritiesPage/components/ExternalCaTable.tsx
View File

@@ -35,7 +35,7 @@ type Props = {
handlePopUpOpen: (
popUpName: keyof UsePopUpState<["ca", "deleteCa", "caStatus", "upgradePlan"]>,
data?: {
caId?: string;
name?: string;
type?: CaType;
status?: CaStatus;
description?: string;
@@ -71,7 +71,7 @@ export const ExternalCaTable = ({ handlePopUpOpen }: Props) => {
key={`ca-${ca.id}`}
onClick={() => {
handlePopUpOpen("ca", {
caId: ca.id,
name: ca.name,
type: ca.type
});
}}
@@ -105,7 +105,7 @@ export const ExternalCaTable = ({ handlePopUpOpen }: Props) => {
onClick={(e) => {
e.stopPropagation();
handlePopUpOpen("ca", {
caId: ca.id,
name: ca.name,
type: ca.type
});
}}
@@ -130,7 +130,7 @@ export const ExternalCaTable = ({ handlePopUpOpen }: Props) => {
onClick={(e) => {
e.stopPropagation();
handlePopUpOpen("caStatus", {
caId: ca.id,
name: ca.name,
type: ca.type,
status:
ca.status === CaStatus.ACTIVE
@@ -158,7 +158,7 @@ export const ExternalCaTable = ({ handlePopUpOpen }: Props) => {
onClick={(e) => {
e.stopPropagation();
handlePopUpOpen("deleteCa", {
caId: ca.id,
name: ca.name,
type: ca.type
});
}}