awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-10-15 16:52:38 +00:00
Code Issues Packages Projects Releases Wiki Activity

misc: addressed comments

Browse Source
This commit is contained in:
Sheen Capadngan
2025-05-17 03:42:49 +08:00
parent 60ea4bb579
commit edefa7698c
25 changed files with 744 additions and 303 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/services/certificate-authority/acme/acme-certificate-authority-fns.ts
+71 -53
View File
@@ -29,7 +29,6 @@ import { getProjectKmsCertificateKeyId } from "@app/services/project/project-fns
import { TCertificateAuthorityDALFactory } from "../certificate-authority-dal";
import { CaStatus, CaType } from "../certificate-authority-enums";
import { keyAlgorithmToAlgCfg } from "../certificate-authority-fns";
import { TCertificateAuthority } from "../certificate-authority-types";
import { TExternalCertificateAuthorityDALFactory } from "../external-certificate-authority-dal";
import { AcmeDnsProvider } from "./acme-certificate-authority-enums";
import { AcmeCertificateAuthorityCredentialsSchema } from "./acme-certificate-authority-schemas";
@@ -62,12 +61,13 @@ type DBConfigurationColumn = {
dnsProvider: string;
directoryUrl: string;
accountEmail: string;
hostedZoneId: string;
};
export const castDbEntryToAcmeCertificateAuthority = (
ca: Awaited<ReturnType<TCertificateAuthorityDALFactory["findByIdWithAssociatedCa"]>>
): TAcmeCertificateAuthority & { credentials: unknown } => {
if (!ca.externalCa) {
if (!ca.externalCa?.id) {
throw new BadRequestError({ message: "Malformed ACME certificate authority" });
}
@@ -82,7 +82,10 @@ export const castDbEntryToAcmeCertificateAuthority = (
credentials: ca.externalCa.credentials,
configuration: {
dnsAppConnectionId: ca.externalCa.dnsAppConnectionId as string,
dnsProvider: dbConfigurationCol.dnsProvider as AcmeDnsProvider,
dnsProviderConfig: {
provider: dbConfigurationCol.dnsProvider as AcmeDnsProvider,
hostedZoneId: dbConfigurationCol.hostedZoneId
},
directoryUrl: dbConfigurationCol.directoryUrl,
accountEmail: dbConfigurationCol.accountEmail
},
@@ -90,7 +93,12 @@ export const castDbEntryToAcmeCertificateAuthority = (
};
};
export const route53InsertTxtRecord = async (connection: TAwsConnectionConfig, domain: string, value: string) => {
export const route53InsertTxtRecord = async (
connection: TAwsConnectionConfig,
hostedZoneId: string,
domain: string,
value: string
) => {
const config = await getAwsConnectionConfig(connection, AWSRegion.US_WEST_1); // REGION is irrelevant because Route53 is global
const route53Client = new Route53Client({
credentials: config.credentials!,
@@ -98,7 +106,7 @@ export const route53InsertTxtRecord = async (connection: TAwsConnectionConfig, d
});
const command = new ChangeResourceRecordSetsCommand({
HostedZoneId: "Z040441124N1GOOMCQYX1", // SHEEN TODO: Get this from user input
HostedZoneId: hostedZoneId,
ChangeBatch: {
Comment: "Set ACME challenge TXT record",
Changes: [
@@ -118,7 +126,12 @@ export const route53InsertTxtRecord = async (connection: TAwsConnectionConfig, d
await route53Client.send(command);
};
export const route53DeleteTxtRecord = async (connection: TAwsConnectionConfig, domain: string, value: string) => {
export const route53DeleteTxtRecord = async (
connection: TAwsConnectionConfig,
hostedZoneId: string,
domain: string,
value: string
) => {
const config = await getAwsConnectionConfig(connection, AWSRegion.US_WEST_1); // REGION is irrelevant because Route53 is global
const route53Client = new Route53Client({
credentials: config.credentials!,
@@ -126,7 +139,7 @@ export const route53DeleteTxtRecord = async (connection: TAwsConnectionConfig, d
});
const command = new ChangeResourceRecordSetsCommand({
HostedZoneId: "Z040441124N1GOOMCQYX1", // SHEEN TODO: same here
HostedZoneId: hostedZoneId,
ChangeBatch: {
Comment: "Delete ACME challenge TXT record",
Changes: [
@@ -173,14 +186,14 @@ export const AcmeCertificateAuthorityFns = ({
disableDirectIssuance: boolean;
actor: OrgServiceActor;
}) => {
const { dnsAppConnectionId, directoryUrl, accountEmail, dnsProvider } = configuration;
const { dnsAppConnectionId, directoryUrl, accountEmail, dnsProviderConfig } = configuration;
const appConnection = await appConnectionDAL.findById(dnsAppConnectionId);
if (!appConnection) {
throw new NotFoundError({ message: `App connection with ID '${dnsAppConnectionId}' not found` });
}
if (dnsProvider === AcmeDnsProvider.Route53 && appConnection.app !== AppConnection.AWS) {
if (dnsProviderConfig.provider === AcmeDnsProvider.Route53 && appConnection.app !== AppConnection.AWS) {
throw new BadRequestError({
message: `App connection with ID '${dnsAppConnectionId}' is not an AWS connection`
});
@@ -207,7 +220,8 @@ export const AcmeCertificateAuthorityFns = ({
configuration: {
directoryUrl,
accountEmail,
dnsProvider
dnsProvider: dnsProviderConfig.provider,
hostedZoneId: dnsProviderConfig.hostedZoneId
},
status
},
@@ -217,19 +231,11 @@ export const AcmeCertificateAuthorityFns = ({
return certificateAuthorityDAL.findByIdWithAssociatedCa(ca.id, tx);
});
if (!caEntity.externalCa) {
if (!caEntity.externalCa?.id) {
throw new BadRequestError({ message: "Failed to create external certificate authority" });
}
return {
id: caEntity.id,
type: CaType.ACME,
disableDirectIssuance: caEntity.disableDirectIssuance,
name: caEntity.externalCa.name,
projectId,
status,
configuration: caEntity.externalCa.configuration
} as TCertificateAuthority;
return castDbEntryToAcmeCertificateAuthority(caEntity);
};
const updateCertificateAuthority = async ({
@@ -237,24 +243,26 @@ export const AcmeCertificateAuthorityFns = ({
status,
configuration,
disableDirectIssuance,
actor
actor,
name
}: {
id: string;
status?: CaStatus;
configuration: TUpdateAcmeCertificateAuthorityDTO["configuration"];
disableDirectIssuance?: boolean;
actor: OrgServiceActor;
name?: string;
}) => {
const updatedCa = await certificateAuthorityDAL.transaction(async (tx) => {
if (configuration) {
const { dnsAppConnectionId, directoryUrl, accountEmail, dnsProvider } = configuration;
const { dnsAppConnectionId, directoryUrl, accountEmail, dnsProviderConfig } = configuration;
const appConnection = await appConnectionDAL.findById(dnsAppConnectionId);
if (!appConnection) {
throw new NotFoundError({ message: `App connection with ID '${dnsAppConnectionId}' not found` });
}
if (dnsProvider === AcmeDnsProvider.Route53 && appConnection.app !== AppConnection.AWS) {
if (dnsProviderConfig.provider === AcmeDnsProvider.Route53 && appConnection.app !== AppConnection.AWS) {
throw new BadRequestError({
message: `App connection with ID '${dnsAppConnectionId}' is not an AWS connection`
});
@@ -273,24 +281,29 @@ export const AcmeCertificateAuthorityFns = ({
type: CaType.ACME
},
{
configuration: { directoryUrl, accountEmail, dnsProvider, dnsAppConnectionId }
dnsAppConnectionId,
configuration: {
directoryUrl,
accountEmail,
dnsProvider: dnsProviderConfig.provider,
hostedZoneId: dnsProviderConfig.hostedZoneId
}
},
tx
);
}
if (status) {
await externalCertificateAuthorityDAL.update(
{
certificateAuthorityId: id,
type: CaType.ACME
},
{
status
},
tx
);
}
await externalCertificateAuthorityDAL.update(
{
certificateAuthorityId: id,
type: CaType.ACME
},
{
name,
status
},
tx
);
if (disableDirectIssuance !== undefined) {
await certificateAuthorityDAL.updateById(
@@ -305,19 +318,11 @@ export const AcmeCertificateAuthorityFns = ({
return certificateAuthorityDAL.findByIdWithAssociatedCa(id, tx);
});
if (!updatedCa.externalCa) {
if (!updatedCa.externalCa?.id) {
throw new BadRequestError({ message: "Failed to update external certificate authority" });
}
return {
id: updatedCa.id,
type: CaType.ACME,
disableDirectIssuance: updatedCa.disableDirectIssuance,
name: updatedCa.externalCa.name,
projectId: updatedCa.projectId,
status: updatedCa.externalCa.status,
configuration: updatedCa.externalCa.configuration
};
return castDbEntryToAcmeCertificateAuthority(updatedCa);
};
const listCertificateAuthorities = async ({ projectId }: { projectId: string }) => {
@@ -329,7 +334,7 @@ export const AcmeCertificateAuthorityFns = ({
return cas.map(castDbEntryToAcmeCertificateAuthority);
};
const orderCertificate = async (subscriberId: string) => {
const orderSubscriberCertificate = async (subscriberId: string) => {
const subscriber = await pkiSubscriberDAL.findById(subscriberId);
if (!subscriber.caId) {
throw new BadRequestError({ message: "Subscriber does not have a CA" });
@@ -341,6 +346,9 @@ export const AcmeCertificateAuthorityFns = ({
}
const acmeCa = castDbEntryToAcmeCertificateAuthority(ca);
if (acmeCa.status !== CaStatus.ACTIVE) {
throw new BadRequestError({ message: "CA is disabled" });
}
const certificateManagerKmsId = await getProjectKmsCertificateKeyId({
projectId: ca.projectId,
@@ -421,16 +429,26 @@ export const AcmeCertificateAuthorityFns = ({
const recordName = `_acme-challenge.${authz.identifier.value}`; // e.g., "_acme-challenge.example.com"
const recordValue = `"${keyAuthorization}"`; // must be double quoted
if (acmeCa.configuration.dnsProvider === AcmeDnsProvider.Route53) {
await route53InsertTxtRecord(connection as TAwsConnection, recordName, recordValue);
if (acmeCa.configuration.dnsProviderConfig.provider === AcmeDnsProvider.Route53) {
await route53InsertTxtRecord(
connection as TAwsConnection,
acmeCa.configuration.dnsProviderConfig.hostedZoneId,
recordName,
recordValue
);
}
},
challengeRemoveFn: async (authz, challenge, keyAuthorization) => {
const recordName = `_acme-challenge.${authz.identifier.value}`; // e.g., "_acme-challenge.example.com"
const recordValue = `"${keyAuthorization}"`; // must be double quoted
if (acmeCa.configuration.dnsProvider === AcmeDnsProvider.Route53) {
await route53DeleteTxtRecord(connection as TAwsConnection, recordName, recordValue);
if (acmeCa.configuration.dnsProviderConfig.provider === AcmeDnsProvider.Route53) {
await route53DeleteTxtRecord(
connection as TAwsConnection,
acmeCa.configuration.dnsProviderConfig.hostedZoneId,
recordName,
recordValue
);
}
}
});
@@ -466,7 +484,7 @@ export const AcmeCertificateAuthorityFns = ({
notAfter: certObj.notAfter,
keyUsages: subscriber.keyUsages as CertKeyUsage[],
extendedKeyUsages: subscriber.extendedKeyUsages as CertExtendedKeyUsage[],
caCertId: "s" // SHEEN TODO: merge Andrey's PR and then remove this
projectId: ca.projectId
},
tx
);
@@ -494,6 +512,6 @@ export const AcmeCertificateAuthorityFns = ({
createCertificateAuthority,
updateCertificateAuthority,
listCertificateAuthorities,
orderCertificate
orderSubscriberCertificate
};
};
backend/src/services/certificate-authority/acme/acme-certificate-authority-schemas.ts
+7 -3
View File
@@ -10,9 +10,13 @@ import { AcmeDnsProvider } from "./acme-certificate-authority-enums";
export const AcmeCertificateAuthorityConfigurationSchema = z.object({
dnsAppConnectionId: z.string().trim(),
dnsProvider: z.nativeEnum(AcmeDnsProvider),
directoryUrl: z.string().trim(),
accountEmail: z.string().trim()
// soon, differentiate via the provider property
dnsProviderConfig: z.object({
provider: z.nativeEnum(AcmeDnsProvider),
hostedZoneId: z.string().trim().min(1)
}),
directoryUrl: z.string().trim().min(1),
accountEmail: z.string().trim().min(1)
});
export const AcmeCertificateAuthorityCredentialsSchema = z.object({
backend/src/services/certificate-authority/certificate-authority-fns.ts
+2 -2
View File
@@ -114,7 +114,7 @@ export const getCaCredentials = async ({
kmsService
}: TGetCaCredentialsDTO) => {
const ca = await certificateAuthorityDAL.findByIdWithAssociatedCa(caId);
if (!ca?.internalCa) throw new NotFoundError({ message: `CA with ID '${caId}' not found` });
if (!ca?.internalCa?.id) throw new NotFoundError({ message: `Internal CA with ID '${caId}' not found` });
const caSecret = await certificateAuthoritySecretDAL.findOne({ caId });
if (!caSecret) throw new NotFoundError({ message: `CA secret for CA with ID '${caId}' not found` });
@@ -257,7 +257,7 @@ export const rebuildCaCrl = async ({
kmsService
}: TRebuildCaCrlDTO) => {
const ca = await certificateAuthorityDAL.findByIdWithAssociatedCa(caId);
if (!ca?.internalCa) throw new NotFoundError({ message: `CA with ID '${caId}' not found` });
if (!ca?.internalCa?.id) throw new NotFoundError({ message: `Internal CA with ID '${caId}' not found` });
const caSecret = await certificateAuthoritySecretDAL.findOne({ caId: ca.id });
backend/src/services/certificate-authority/certificate-authority-queue.ts
+7 -4
View File
@@ -4,7 +4,7 @@ import crypto from "crypto";
import { KeyStorePrefixes, TKeyStoreFactory } from "@app/keystore/keystore";
import { getConfig } from "@app/lib/config/env";
import { daysToMillisecond, secondsToMillis } from "@app/lib/dates";
import { NotFoundError } from "@app/lib/errors";
import { BadRequestError, NotFoundError } from "@app/lib/errors";
import { logger } from "@app/lib/logger";
import { QueueJobs, QueueName, TQueueServiceFactory } from "@app/queue";
import { TCertificateDALFactory } from "@app/services/certificate/certificate-dal";
@@ -114,6 +114,11 @@ export const certificateAuthorityQueueFactory = ({
};
const orderCertificateForSubscriber = async ({ subscriberId, caType }: TOrderCertificateForSubscriberDTO) => {
const entry = await keyStore.getItem(KeyStorePrefixes.CaOrderCertificateForSubscriberLock(subscriberId));
if (entry) {
throw new BadRequestError({ message: `Certificate order already in progress for subscriber ${subscriberId}` });
}
await queueService.queue(
QueueName.CaLifecycle,
QueueJobs.CaOrderCertificateForSubscriber,
@@ -137,8 +142,6 @@ export const certificateAuthorityQueueFactory = ({
try {
lock = await keyStore.acquireLock(
[KeyStorePrefixes.CaOrderCertificateForSubscriberLock(subscriberId)],
// scott: not sure on this duration; syncs can take excessive amounts of time so we need to keep it locked,
// but should always release below...
5 * 60 * 1000
);
} catch (e) {
@@ -148,7 +151,7 @@ export const certificateAuthorityQueueFactory = ({
try {
if (caType === CaType.ACME) {
await acmeFns.orderCertificate(subscriberId);
await acmeFns.orderSubscriberCertificate(subscriberId);
}
} catch (e) {
logger.error(e, `CaOrderCertificate Failed [subscriberId=${subscriberId}] [job=${job.name}]`);
backend/src/services/certificate-authority/certificate-authority-service.ts
+29 -28
View File
@@ -14,7 +14,10 @@ import { TCertificateSecretDALFactory } from "../certificate/certificate-secret-
import { TKmsServiceFactory } from "../kms/kms-service";
import { TPkiSubscriberDALFactory } from "../pki-subscriber/pki-subscriber-dal";
import { TProjectDALFactory } from "../project/project-dal";
import { AcmeCertificateAuthorityFns } from "./acme/acme-certificate-authority-fns";
import {
AcmeCertificateAuthorityFns,
castDbEntryToAcmeCertificateAuthority
} from "./acme/acme-certificate-authority-fns";
import {
TCreateAcmeCertificateAuthorityDTO,
TUpdateAcmeCertificateAuthorityDTO
@@ -153,6 +156,8 @@ export const certificateAuthorityServiceFactory = ({
actor
});
}
throw new BadRequestError({ message: "Invalid certificate authority type" });
};
const findCertificateAuthorityById = async (
@@ -181,9 +186,9 @@ export const certificateAuthorityServiceFactory = ({
);
if (type === CaType.INTERNAL) {
if (!certificateAuthority.internalCa) {
if (!certificateAuthority.internalCa?.id) {
throw new NotFoundError({
message: `Could not find internal certificate authority with ID "${certificateAuthorityId}"`
message: `Internal certificate authority with ID "${certificateAuthorityId}" not found`
});
}
@@ -204,14 +209,11 @@ export const certificateAuthorityServiceFactory = ({
});
}
return {
id: certificateAuthority.id,
type,
disableDirectIssuance: certificateAuthority.disableDirectIssuance,
name: certificateAuthority.externalCa.name,
projectId: certificateAuthority.projectId,
configuration: certificateAuthority.externalCa.configuration
} as TCertificateAuthority;
if (type === CaType.ACME) {
return castDbEntryToAcmeCertificateAuthority(certificateAuthority);
}
throw new BadRequestError({ message: "Invalid certificate authority type" });
};
const listCertificateAuthoritiesByProjectId = async (
@@ -264,10 +266,12 @@ export const certificateAuthorityServiceFactory = ({
if (type === CaType.ACME) {
return acmeFns.listCertificateAuthorities({ projectId: finalProjectId });
}
throw new BadRequestError({ message: "Invalid certificate authority type" });
};
const updateCertificateAuthority = async (
{ id, type, configuration, disableDirectIssuance, status }: TUpdateCertificateAuthorityDTO,
{ id, type, configuration, disableDirectIssuance, status, name }: TUpdateCertificateAuthorityDTO,
actor: OrgServiceActor
) => {
const certificateAuthority = await certificateAuthorityDAL.findByIdWithAssociatedCa(id);
@@ -292,9 +296,9 @@ export const certificateAuthorityServiceFactory = ({
);
if (type === CaType.INTERNAL) {
if (!certificateAuthority.internalCa) {
if (!certificateAuthority.internalCa?.id) {
throw new NotFoundError({
message: `Could not find internal certificate authority with ID "${id}"`
message: `Internal certificate authority with ID "${id}" not found`
});
}
@@ -328,7 +332,8 @@ export const certificateAuthorityServiceFactory = ({
configuration: configuration as TUpdateAcmeCertificateAuthorityDTO["configuration"],
disableDirectIssuance,
actor,
status
status,
name
});
}
@@ -357,15 +362,15 @@ export const certificateAuthorityServiceFactory = ({
ProjectPermissionSub.CertificateAuthorities
);
if (!certificateAuthority.internalCa && type === CaType.INTERNAL) {
if (!certificateAuthority.internalCa?.id && type === CaType.INTERNAL) {
throw new BadRequestError({
message: "Certificate authority cannot be deleted due to mismatching type"
message: "Internal certificate authority cannot be deleted"
});
}
if (certificateAuthority.externalCa && certificateAuthority.externalCa.type !== type) {
if (certificateAuthority.externalCa?.id && certificateAuthority.externalCa.type !== type) {
throw new BadRequestError({
message: "Certificate authority cannot be deleted due to mismatching type"
message: "External certificate authority cannot be deleted"
});
}
@@ -383,15 +388,11 @@ export const certificateAuthorityServiceFactory = ({
} as TCertificateAuthority;
}
return {
id: certificateAuthority.id,
type,
disableDirectIssuance: certificateAuthority.disableDirectIssuance,
name: certificateAuthority.externalCa?.name,
projectId: certificateAuthority.projectId,
configuration: certificateAuthority.externalCa?.configuration,
status: certificateAuthority.externalCa?.status
} as TCertificateAuthority;
if (type === CaType.ACME) {
return castDbEntryToAcmeCertificateAuthority(certificateAuthority);
}
throw new BadRequestError({ message: "Invalid certificate authority type" });
};
return {
backend/src/services/certificate-authority/certificate-authority-types.ts
+1 -3
View File
@@ -9,9 +9,7 @@ export type TCertificateAuthority = TInternalCertificateAuthority | TAcmeCertifi
export type TCertificateAuthorityInput = TInternalCertificateAuthorityInput | TAcmeCertificateAuthorityInput;
export type TCreateCertificateAuthorityDTO = Omit<TCertificateAuthority, "type" | "id"> & {
type: CaType;
};
export type TCreateCertificateAuthorityDTO = Omit<TCertificateAuthority, "id">;
export type TUpdateCertificateAuthorityDTO = Partial<Omit<TCreateCertificateAuthorityDTO, "projectId">> & {
type: CaType;
backend/src/services/certificate-authority/internal/internal-certificate-authority-fns.ts
+2 -1
View File
@@ -225,7 +225,8 @@ export const InternalCertificateAuthorityFns = ({
notBefore: notBeforeDate,
notAfter: notAfterDate,
keyUsages: selectedKeyUsages,
extendedKeyUsages: subscriber.extendedKeyUsages as CertExtendedKeyUsage[]
extendedKeyUsages: subscriber.extendedKeyUsages as CertExtendedKeyUsage[],
projectId: ca.projectId
},
tx
);
backend/src/services/certificate-authority/internal/internal-certificate-authority-service.ts
+26 -17
View File
@@ -1209,8 +1209,8 @@ export const internalCertificateAuthorityServiceFactory = ({
ca = await certificateAuthorityDAL.findByIdWithAssociatedCa(certificateTemplate.caId);
}
if (!ca?.internalCa) {
throw new NotFoundError({ message: `CA with ID '${caId}' not found` });
if (!ca?.internalCa?.id) {
throw new NotFoundError({ message: `Internal CA with ID '${caId}' not found` });
}
const { permission } = await permissionService.getProjectPermission({
@@ -1475,7 +1475,8 @@ export const internalCertificateAuthorityServiceFactory = ({
notBefore: notBeforeDate,
notAfter: notAfterDate,
keyUsages: selectedKeyUsages,
extendedKeyUsages: selectedExtendedKeyUsages
extendedKeyUsages: selectedExtendedKeyUsages,
projectId: ca.projectId
},
tx
);
@@ -1560,8 +1561,8 @@ export const internalCertificateAuthorityServiceFactory = ({
ca = await certificateAuthorityDAL.findByIdWithAssociatedCa(certificateTemplate.caId);
}
if (!ca?.internalCa) {
throw new NotFoundError({ message: `CA with ID '${caId}' not found` });
if (!ca?.internalCa?.id) {
throw new NotFoundError({ message: `Internal CA with ID '${caId}' not found` });
}
if (!dto.isInternal) {
@@ -1854,6 +1855,20 @@ export const internalCertificateAuthorityServiceFactory = ({
plainText: Buffer.from(new Uint8Array(leafCert.rawData))
});
const { caCert: issuingCaCertificate, caCertChain } = await getCaCertChain({
caCertId: ca.internalCa.activeCaCertId,
certificateAuthorityDAL,
certificateAuthorityCertDAL,
projectDAL,
kmsService
});
const certificateChainPem = `${issuingCaCertificate}\n${caCertChain}`.trim();
const { cipherTextBlob: encryptedCertificateChain } = await kmsEncryptor({
plainText: Buffer.from(certificateChainPem)
});
await certificateDAL.transaction(async (tx) => {
const cert = await certificateDAL.create(
{
@@ -1868,7 +1883,8 @@ export const internalCertificateAuthorityServiceFactory = ({
notBefore: notBeforeDate,
notAfter: notAfterDate,
keyUsages: selectedKeyUsages,
extendedKeyUsages: selectedExtendedKeyUsages
extendedKeyUsages: selectedExtendedKeyUsages,
projectId: ca.projectId
},
tx
);
@@ -1876,7 +1892,8 @@ export const internalCertificateAuthorityServiceFactory = ({
await certificateBodyDAL.create(
{
certId: cert.id,
encryptedCertificate
encryptedCertificate,
encryptedCertificateChain
},
tx
);
@@ -1894,17 +1911,9 @@ export const internalCertificateAuthorityServiceFactory = ({
return cert;
});
const { caCert: issuingCaCertificate, caCertChain } = await getCaCertChain({
caCertId: ca.internalCa.activeCaCertId,
certificateAuthorityDAL,
certificateAuthorityCertDAL,
projectDAL,
kmsService
});
return {
certificate: leafCert,
certificateChain: `${issuingCaCertificate}\n${caCertChain}`.trim(),
certificateChain: certificateChainPem,
issuingCaCertificate,
serialNumber,
ca: expandInternalCa(ca),
@@ -1923,7 +1932,7 @@ export const internalCertificateAuthorityServiceFactory = ({
actorOrgId
}: TGetCaCertificateTemplatesDTO) => {
const ca = await certificateAuthorityDAL.findByIdWithAssociatedCa(caId);
if (!ca?.internalCa) throw new NotFoundError({ message: `CA with ID '${caId}' not found` });
if (!ca?.internalCa?.id) throw new NotFoundError({ message: `Internal CA with ID '${caId}' not found` });
const { permission } = await permissionService.getProjectPermission({
actor,