awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-10-15 04:14:38 +00:00
Code Issues Packages Projects Releases Wiki Activity

Transfer cert endpoints to work with serial numbers

Browse Source
This commit is contained in:
Tuan Dang
2024-05-29 16:12:46 -07:00
parent f9847f48b0
commit a2a786f392
23 changed files with 346 additions and 139 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/services/certificate-authority/certificate-authority-service.ts
+27 -7
View File
@@ -1,3 +1,4 @@
/* eslint-disable no-bitwise */
import { ForbiddenError } from "@casl/ability";
import * as x509 from "@peculiar/x509";
import crypto, { KeyObject } from "crypto";
@@ -9,6 +10,7 @@ import { TCertificateCertDALFactory } from "@app/services/certificate/certificat
import { TCertificateDALFactory } from "@app/services/certificate/certificate-dal";
import { TProjectDALFactory } from "@app/services/project/project-dal";
import { TCertStatus } from "../certificate/certificate-types";
import { TCertificateAuthorityCertDALFactory } from "./certificate-authority-cert-dal";
import { TCertificateAuthorityDALFactory } from "./certificate-authority-dal";
import { createDistinguishedName } from "./certificate-authority-fns";
@@ -118,6 +120,7 @@ export const certificateAuthorityServiceFactory = ({
? new Date(notAfter)
: new Date(new Date().setFullYear(new Date().getFullYear() + 10));
const serialNumber = crypto.randomBytes(32).toString("hex");
const ca = await certificateAuthorityDAL.create(
{
projectId: project.id,
@@ -130,7 +133,7 @@ export const certificateAuthorityServiceFactory = ({
commonName,
status: type === CaType.ROOT ? CaStatus.ACTIVE : CaStatus.PENDING_CERTIFICATE,
dn,
...(type === CaType.ROOT && { maxPathLength, notBefore: notBeforeDate, notAfter: notAfterDate })
...(type === CaType.ROOT && { maxPathLength, notBefore: notBeforeDate, notAfter: notAfterDate, serialNumber })
},
tx
);
@@ -140,6 +143,7 @@ export const certificateAuthorityServiceFactory = ({
const cert = await x509.X509CertificateGenerator.createSelfSigned({
name: dn,
serialNumber,
notBefore: notBeforeDate,
notAfter: notAfterDate,
signingAlgorithm: alg,
@@ -291,7 +295,12 @@ export const certificateAuthorityServiceFactory = ({
signingAlgorithm: alg,
extensions: [
// eslint-disable-next-line no-bitwise
new x509.KeyUsagesExtension(x509.KeyUsageFlags.digitalSignature | x509.KeyUsageFlags.keyEncipherment)
new x509.KeyUsagesExtension(
x509.KeyUsageFlags.keyCertSign |
x509.KeyUsageFlags.cRLSign |
x509.KeyUsageFlags.digitalSignature |
x509.KeyUsageFlags.keyEncipherment
)
],
attributes: [new x509.ChallengePasswordAttribute("password")]
});
@@ -411,8 +420,9 @@ export const certificateAuthorityServiceFactory = ({
throw new BadRequestError({ message: "notAfter date is after CA certificate's notAfter date" });
}
const serialNumber = crypto.randomBytes(32).toString("hex");
const intermediateCert = await x509.X509CertificateGenerator.create({
// serialNumber: "03",
serialNumber,
subject: csrObj.subject,
issuer: certObj.subject,
notBefore: notBeforeDate,
@@ -421,7 +431,13 @@ export const certificateAuthorityServiceFactory = ({
publicKey: csrObj.publicKey,
signingAlgorithm: alg,
extensions: [
new x509.KeyUsagesExtension(x509.KeyUsageFlags.dataEncipherment, true),
new x509.KeyUsagesExtension(
x509.KeyUsageFlags.keyCertSign |
x509.KeyUsageFlags.cRLSign |
x509.KeyUsageFlags.digitalSignature |
x509.KeyUsageFlags.keyEncipherment,
true
),
new x509.BasicConstraintsExtension(true, maxPathLength === -1 ? undefined : maxPathLength, true),
await x509.AuthorityKeyIdentifierExtension.create(certObj, false),
await x509.SubjectKeyIdentifierExtension.create(csrObj.publicKey)
@@ -511,6 +527,7 @@ export const certificateAuthorityServiceFactory = ({
maxPathLength: maxPathLength === undefined ? -1 : maxPathLength,
notBefore: new Date(certObj.notBefore),
notAfter: new Date(certObj.notAfter),
serialNumber: certObj.serialNumber,
parentCaId: parentCa?.id
},
tx
@@ -601,8 +618,9 @@ export const certificateAuthorityServiceFactory = ({
throw new BadRequestError({ message: "notAfter date is after CA certificate's notAfter date" });
}
const serialNumber = crypto.randomBytes(32).toString("hex");
const leafCert = await x509.X509CertificateGenerator.create({
// serialNumber: "03",
serialNumber,
subject: csrObj.subject,
issuer: caCertObj.subject,
notBefore: notBeforeDate,
@@ -611,7 +629,7 @@ export const certificateAuthorityServiceFactory = ({
publicKey: csrObj.publicKey,
signingAlgorithm: alg,
extensions: [
new x509.KeyUsagesExtension(x509.KeyUsageFlags.dataEncipherment, true),
new x509.KeyUsagesExtension(x509.KeyUsageFlags.digitalSignature | x509.KeyUsageFlags.keyEncipherment, true),
new x509.BasicConstraintsExtension(false),
await x509.AuthorityKeyIdentifierExtension.create(caCertObj, false),
await x509.SubjectKeyIdentifierExtension.create(csrObj.publicKey)
@@ -627,7 +645,9 @@ export const certificateAuthorityServiceFactory = ({
const cert = await certificateDAL.create(
{
caId: ca.id,
status: TCertStatus.ACTIVE,
commonName,
serialNumber,
notBefore: notBeforeDate,
notAfter: notAfterDate
},
@@ -651,7 +671,7 @@ export const certificateAuthorityServiceFactory = ({
certificateChain: chain.join("\n"),
issuingCaCertificate: caCert.certificate,
privateKey: skLeaf,
serialNumber: leafCert.serialNumber
serialNumber
};
};
backend/src/services/certificate-authority/certificate-authority-types.ts
-2
View File
@@ -11,8 +11,6 @@ export enum CaStatus {
PENDING_CERTIFICATE = "pending-certificate"
}
// TODO: attach permissions after draft impl
export type TCreateCaDTO = {
projectSlug: string;
type: CaType;
backend/src/services/certificate/certificate-service.ts
+35 -11
View File
@@ -7,10 +7,10 @@ import { TCertificateCertDALFactory } from "@app/services/certificate/certificat
import { TCertificateDALFactory } from "@app/services/certificate/certificate-dal";
import { TCertificateAuthorityDALFactory } from "@app/services/certificate-authority/certificate-authority-dal";
import { TDeleteCertDTO, TGetCertCertDTO, TGetCertDTO } from "./certificate-types";
import { TDeleteCertDTO, TGetCertCertDTO, TGetCertDTO, TRevokeCertDTO } from "./certificate-types";
type TCertificateServiceFactoryDep = {
certificateDAL: Pick<TCertificateDALFactory, "findById" | "deleteById">;
certificateDAL: Pick<TCertificateDALFactory, "findOne" | "deleteById">;
certificateCertDAL: Pick<TCertificateCertDALFactory, "findOne">;
certificateAuthorityDAL: Pick<TCertificateAuthorityDALFactory, "findById">;
permissionService: Pick<TPermissionServiceFactory, "getProjectPermission">;
@@ -24,8 +24,8 @@ export const certificateServiceFactory = ({
certificateAuthorityDAL,
permissionService
}: TCertificateServiceFactoryDep) => {
const getCertById = async ({ certId, actorId, actorAuthMethod, actor, actorOrgId }: TGetCertDTO) => {
const cert = await certificateDAL.findById(certId);
const getCert = async ({ serialNumber, actorId, actorAuthMethod, actor, actorOrgId }: TGetCertDTO) => {
const cert = await certificateDAL.findOne({ serialNumber });
const ca = await certificateAuthorityDAL.findById(cert.caId);
const { permission } = await permissionService.getProjectPermission(
@@ -41,8 +41,8 @@ export const certificateServiceFactory = ({
return cert;
};
const deleteCertById = async ({ certId, actorId, actorAuthMethod, actor, actorOrgId }: TDeleteCertDTO) => {
const cert = await certificateDAL.findById(certId);
const deleteCert = async ({ serialNumber, actorId, actorAuthMethod, actor, actorOrgId }: TDeleteCertDTO) => {
const cert = await certificateDAL.findOne({ serialNumber });
const ca = await certificateAuthorityDAL.findById(cert.caId);
const { permission } = await permissionService.getProjectPermission(
@@ -59,8 +59,31 @@ export const certificateServiceFactory = ({
return deletedCert;
};
const getCertCert = async ({ certId, actorId, actorAuthMethod, actor, actorOrgId }: TGetCertCertDTO) => {
const cert = await certificateDAL.findById(certId);
const revokeCert = async ({ serialNumber, actorId, actorAuthMethod, actor, actorOrgId }: TRevokeCertDTO) => {
const cert = await certificateDAL.findOne({ serialNumber });
const ca = await certificateAuthorityDAL.findById(cert.caId);
const { permission } = await permissionService.getProjectPermission(
actor,
actorId,
ca.projectId,
actorAuthMethod,
actorOrgId
);
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Delete, ProjectPermissionSub.Certificates);
// WIP
// const revocationDate = new Date();
// const serialNumber2 = crypto.randomBytes(16).toString("hex");
// const crlEntry = new x509.X509CrlEntry(serialNumber2, new Date(), []);
return {};
};
const getCertCert = async ({ serialNumber, actorId, actorAuthMethod, actor, actorOrgId }: TGetCertCertDTO) => {
const cert = await certificateDAL.findOne({ serialNumber });
const ca = await certificateAuthorityDAL.findById(cert.caId);
const { permission } = await permissionService.getProjectPermission(
@@ -73,7 +96,7 @@ export const certificateServiceFactory = ({
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.Certificates);
const certCert = await certificateCertDAL.findOne({ certId });
const certCert = await certificateCertDAL.findOne({ certId: cert.id });
const certObj = new x509.X509Certificate(certCert.certificate);
return {
@@ -84,8 +107,9 @@ export const certificateServiceFactory = ({
};
return {
getCertById,
deleteCertById,
getCert,
deleteCert,
revokeCert,
getCertCert
};
};
backend/src/services/certificate/certificate-types.ts
+12 -3
View File
@@ -1,13 +1,22 @@
import { TProjectPermission } from "@app/lib/types";
export enum TCertStatus {
ACTIVE = "active",
REVOKED = "revoked"
}
export type TGetCertDTO = {
certId: string;
serialNumber: string;
} & Omit<TProjectPermission, "projectId">;
export type TDeleteCertDTO = {
certId: string;
serialNumber: string;
} & Omit<TProjectPermission, "projectId">;
export type TRevokeCertDTO = {
serialNumber: string;
} & Omit<TProjectPermission, "projectId">;
export type TGetCertCertDTO = {
certId: string;
serialNumber: string;
} & Omit<TProjectPermission, "projectId">;
backend/src/services/project/project-service.ts
+1 -1
View File
@@ -67,7 +67,7 @@ type TProjectServiceFactoryDep = {
projectUserMembershipRoleDAL: Pick<TProjectUserMembershipRoleDALFactory, "create">;
secretBlindIndexDAL: Pick<TSecretBlindIndexDALFactory, "create">;
certificateAuthorityDAL: Pick<TCertificateAuthorityDALFactory, "find">;
certificateDAL: TCertificateDALFactory;
certificateDAL: Pick<TCertificateDALFactory, "find">;
permissionService: TPermissionServiceFactory;
orgService: Pick<TOrgServiceFactory, "addGhostUser">;
licenseService: Pick<TLicenseServiceFactory, "getPlan">;