mirror of
https://github.com/shankar0123/certctl.git
synced 2026-06-14 07:38:54 +00:00
acme-server: orders + authorizations + finalize + cert download (Phase 2/7)
Closes the issuance loop in trust_authenticated mode (commitsec88a61+44a85d6wired the foundation + JWS-verified account resource). After this commit, an ACME client running against a profile with acme_auth_mode='trust_authenticated' end-to-end-issues a real cert: POST /acme/profile/<id>/new-order → 201 + order URL (status=ready) POST /acme/profile/<id>/order/<oid> → POST-as-GET fetch POST /acme/profile/<id>/order/<oid>/finalize → 200 + status=valid + cert URL POST /acme/profile/<id>/cert/<cid> → 200 + PEM chain Profiles with acme_auth_mode='challenge' get the same code path with authz/challenge rows in `pending` state until Phase 3's validators wire up. The mode is read from the bound profile's column at request time, NOT cached at server start — operators flipping the column via SQL take effect on the next order without restart. Architecture (the load-bearing part): - Finalize routes through service.CertificateService.Create — the canonical certctl issuance entry point that wraps the managed_certificates row insert + audit row in s.tx.WithinTx. RenewalPolicy / CertificateProfile / per-issuer-type Prometheus metrics / audit rows all apply uniformly to ACME-issued certs via the same code path that already serves EST/SCEP/agent/REST issuance. - Identifier validation runs BEFORE order creation. Rejected identifiers return RFC 7807 with per-identifier subproblems and create no order row. - Source stamp on managed_certificates: domain.CertificateSourceACME. Operators bulk-revoke ACME-issued certs by filtering on Source=ACME. - 3-step atomicity boundary documented in code + this commit msg: (A) WithinTx-A marks order processing + audit row. (B) IssuerConnector.IssueCertificate + CertificateService.Create (each in its own WithinTx — Create wraps cert row + audit atomically). (C) WithinTx-C creates certificate_versions row + transitions order to valid + sets certificate_id + audit row. The brief window between B and C can leave a managed_certificates row whose order is still in `processing`. Phase 5's GC scheduler reconciles. Documented inline. What ships: - internal/api/acme/order.go: OrderResponseJSON + AuthorizationResponseJSON + ChallengeResponseJSON + NewOrderRequest + FinalizeRequest wire shapes; ValidateIdentifiers (Phase 2 syntactic checks, dns-only); CSRMatchesIdentifiers (RFC 8555 §7.4 strict equality, case-folded). - internal/domain/acme.go: ACMEOrder + ACMEAuthorization + ACMEChallenge + ACMEIdentifier + ACMEProblem domain types + closed status enums for each (order: pending|ready|processing|valid|invalid; authz: pending|valid|invalid|deactivated|expired|revoked; challenge: pending|processing|valid|invalid; challenge type: http-01|dns-01| tls-alpn-01). - internal/domain/profile.go: new ACMEAuthMode field reading from certificate_profiles.acme_auth_mode (added in migration 25). - internal/domain/certificate.go: new CertificateSourceACME enum value. - internal/repository/postgres/profile.go: extended SELECT/scanProfile to read the per-profile acme_auth_mode column with a COALESCE default of trust_authenticated. - internal/repository/postgres/acme.go: full order/authz/challenge CRUD (CreateOrderWithTx + GetOrderByID + UpdateOrderWithTx + CreateAuthzWithTx + GetAuthzByID + ListAuthzsByOrder + ListChallengesByAuthz + CreateChallengeWithTx) with proper sql.NullTime + JSONB handling. scanACMEOrder / scanACMEAuthz / scanACMEChallenge helpers. - internal/service/acme.go: extended ACMERepo interface; new SetIssuancePipeline wires certificateService + certificateRepo + issuerRegistry. CreateOrder (auth-mode-dispatched: trust_authenticated auto-marks order ready + authz valid + 1 placeholder http-01 challenge valid; challenge mode keeps everything pending). LookupOrder (with account-ownership assertion). LookupAuthz. ListAuthzsByOrder. FinalizeOrder (3-step atomicity boundary as above; CSR-vs-order SAN strict-equality check before issuance; persists FinalizeOrderResult {Order, CertID}). LookupCertificate. randIDSuffix + base32encode helpers for the human-readable acme-ord-* / acme-authz-* / acme-chall-* prefixes (CLAUDE.md "TEXT primary keys with human- readable prefixes" architecture decision). 8 new per-op metrics. - internal/service/acme_test.go: extended fakeACMERepo with Phase 2 interface stubs; new orderTrackingRepo for observable persistence; 2 new tests asserting trust_authenticated → auto-ready/valid and challenge → stays-pending. - internal/api/handler/acme.go: NewOrder + Order + OrderFinalize + Authz + Cert handler methods. orderURL / authzURL / certURL / challengeURLBuilder helpers; marshalOrderForResponse fetches per-order authzs to populate the URL list. parseOptionalTime for notBefore / notAfter. - internal/api/handler/acme_handler_test.go: extended mockACMEService with Phase 2 method stubs; 4 new handler tests (NewOrder happy + rejected-identifier + OrderFinalize bad-CSR + Cert happy). - internal/api/router/router.go: 10 new Register calls (5 per-profile + 5 shorthand) for new-order, order/{ord_id}, order/{ord_id}/finalize, authz/{authz_id}, cert/{cert_id}. - internal/api/router/openapi_parity_test.go + api/openapi-handler-exceptions.yaml: 10 new exception entries. - cmd/server/main.go: SetIssuancePipeline at startup, threading certificateService + certificateRepo + issuerRegistry into ACMEService. - docs/acme-server.md: phase status updated; endpoints table grows 5 rows for new-order/order/finalize/authz/cert (per-profile + shorthand variants); new section "Finalize routing through CertificateService.Create" documenting the 3-step atomicity boundary + the actor-string convention `acme:<account-id>`. Tests: ACME package + service + handler + router + config + domain all green under -short. New cases: - TestCreateOrder_TrustAuthenticated_AutoReady (asserts auto-ready transition + valid-status authz/challenge + audit row + metric bump). - TestCreateOrder_ChallengeMode_StaysPending (asserts pending-status cascading authz/challenge for challenge mode). - TestACMEHandler_NewOrder_HappyPath (asserts 201 + Location + finalize URL shape). - TestACMEHandler_NewOrder_RejectedIdentifier (asserts 400 + RFC 7807 rejectedIdentifier + per-identifier subproblems for type=ip). - TestACMEHandler_OrderFinalize_BadCSR (asserts 400 + badCSR for non-base64 CSR field). - TestACMEHandler_Cert_HappyPath (asserts 200 + PEM content-type + PEM chain in body). Engineering history: cowork/WORKSPACE-CHANGELOG.md "ACME-Server-2".
This commit is contained in:
shankar0123
@@ -112,6 +112,32 @@ func (f *fakeACMERepo) UpdateAccountStatusWithTx(ctx context.Context, q reposito
|
||||
return nil
|
||||
}
|
||||
|
||||
// Phase 2 — order / authz / challenge state. Phase 1b tests don't use
|
||||
// these; the no-op stubs keep the *fakeACMERepo type satisfying the
|
||||
// extended ACMERepo interface. Phase 2's tests overwrite these as
|
||||
// needed.
|
||||
func (f *fakeACMERepo) CreateOrderWithTx(ctx context.Context, q repository.Querier, order *domain.ACMEOrder) error {
|
||||
return nil
|
||||
}
|
||||
func (f *fakeACMERepo) GetOrderByID(ctx context.Context, orderID string) (*domain.ACMEOrder, error) {
|
||||
return nil, repository.ErrNotFound
|
||||
}
|
||||
func (f *fakeACMERepo) UpdateOrderWithTx(ctx context.Context, q repository.Querier, order *domain.ACMEOrder) error {
|
||||
return nil
|
||||
}
|
||||
func (f *fakeACMERepo) CreateAuthzWithTx(ctx context.Context, q repository.Querier, authz *domain.ACMEAuthorization) error {
|
||||
return nil
|
||||
}
|
||||
func (f *fakeACMERepo) GetAuthzByID(ctx context.Context, authzID string) (*domain.ACMEAuthorization, error) {
|
||||
return nil, repository.ErrNotFound
|
||||
}
|
||||
func (f *fakeACMERepo) ListAuthzsByOrder(ctx context.Context, orderID string) ([]*domain.ACMEAuthorization, error) {
|
||||
return nil, nil
|
||||
}
|
||||
func (f *fakeACMERepo) CreateChallengeWithTx(ctx context.Context, q repository.Querier, ch *domain.ACMEChallenge) error {
|
||||
return nil
|
||||
}
|
||||
|
||||
// fakeTransactor is the repository.Transactor stand-in: runs fn
|
||||
// against the supplied querier (we just pass nil — fakes ignore it).
|
||||
// Mirrors how production transactor works without an actual DB.
|
||||
@@ -482,3 +508,130 @@ func TestNewAccount_RequiresTransactor(t *testing.T) {
|
||||
t.Fatal("expected error when transactor is unset")
|
||||
}
|
||||
}
|
||||
|
||||
// --- Phase 2 — order creation in trust_authenticated mode -------------
|
||||
|
||||
// orderTrackingRepo wraps fakeACMERepo so CreateOrder + CreateAuthz +
|
||||
// CreateChallenge persistence is observable in tests. The fakeACMERepo's
|
||||
// stubs no-op; this overrides them.
|
||||
type orderTrackingRepo struct {
|
||||
*fakeACMERepo
|
||||
orders map[string]*domain.ACMEOrder
|
||||
authzs map[string][]*domain.ACMEAuthorization // orderID → authzs
|
||||
challenges map[string][]domain.ACMEChallenge // authzID → challenges
|
||||
}
|
||||
|
||||
func newOrderTrackingRepo() *orderTrackingRepo {
|
||||
return &orderTrackingRepo{
|
||||
fakeACMERepo: newFakeACMERepo(),
|
||||
orders: map[string]*domain.ACMEOrder{},
|
||||
authzs: map[string][]*domain.ACMEAuthorization{},
|
||||
challenges: map[string][]domain.ACMEChallenge{},
|
||||
}
|
||||
}
|
||||
|
||||
func (r *orderTrackingRepo) CreateOrderWithTx(ctx context.Context, q repository.Querier, order *domain.ACMEOrder) error {
|
||||
cp := *order
|
||||
r.orders[order.OrderID] = &cp
|
||||
return nil
|
||||
}
|
||||
func (r *orderTrackingRepo) GetOrderByID(ctx context.Context, orderID string) (*domain.ACMEOrder, error) {
|
||||
o, ok := r.orders[orderID]
|
||||
if !ok {
|
||||
return nil, repository.ErrNotFound
|
||||
}
|
||||
cp := *o
|
||||
return &cp, nil
|
||||
}
|
||||
func (r *orderTrackingRepo) UpdateOrderWithTx(ctx context.Context, q repository.Querier, order *domain.ACMEOrder) error {
|
||||
cp := *order
|
||||
r.orders[order.OrderID] = &cp
|
||||
return nil
|
||||
}
|
||||
func (r *orderTrackingRepo) CreateAuthzWithTx(ctx context.Context, q repository.Querier, authz *domain.ACMEAuthorization) error {
|
||||
cp := *authz
|
||||
r.authzs[authz.OrderID] = append(r.authzs[authz.OrderID], &cp)
|
||||
return nil
|
||||
}
|
||||
func (r *orderTrackingRepo) ListAuthzsByOrder(ctx context.Context, orderID string) ([]*domain.ACMEAuthorization, error) {
|
||||
return r.authzs[orderID], nil
|
||||
}
|
||||
func (r *orderTrackingRepo) CreateChallengeWithTx(ctx context.Context, q repository.Querier, ch *domain.ACMEChallenge) error {
|
||||
r.challenges[ch.AuthzID] = append(r.challenges[ch.AuthzID], *ch)
|
||||
return nil
|
||||
}
|
||||
|
||||
func TestCreateOrder_TrustAuthenticated_AutoReady(t *testing.T) {
|
||||
cfg := config.ACMEServerConfig{NonceTTL: 5 * time.Minute, OrderTTL: 24 * time.Hour, AuthzTTL: 24 * time.Hour}
|
||||
repo := newOrderTrackingRepo()
|
||||
pl := &fakeProfileLookup{profiles: map[string]*domain.CertificateProfile{
|
||||
"prof-corp": {ID: "prof-corp", Name: "corp", ACMEAuthMode: "trust_authenticated"},
|
||||
}}
|
||||
auditRepo := &fakeAuditRepo{}
|
||||
auditSvc := NewAuditService(auditRepo)
|
||||
svc := NewACMEService(repo, pl, cfg)
|
||||
svc.SetTransactor(&fakeTransactor{})
|
||||
svc.SetAuditService(auditSvc)
|
||||
|
||||
order, err := svc.CreateOrder(context.Background(), "acme-acc-X", "prof-corp",
|
||||
[]domain.ACMEIdentifier{{Type: "dns", Value: "example.com"}}, nil, nil)
|
||||
if err != nil {
|
||||
t.Fatalf("CreateOrder: %v", err)
|
||||
}
|
||||
if order.Status != domain.ACMEOrderStatusReady {
|
||||
t.Errorf("order status = %q, want ready (trust_authenticated)", order.Status)
|
||||
}
|
||||
authzs := repo.authzs[order.OrderID]
|
||||
if len(authzs) != 1 {
|
||||
t.Fatalf("authzs = %d, want 1", len(authzs))
|
||||
}
|
||||
if authzs[0].Status != domain.ACMEAuthzStatusValid {
|
||||
t.Errorf("authz status = %q, want valid (trust_authenticated)", authzs[0].Status)
|
||||
}
|
||||
chs := repo.challenges[authzs[0].AuthzID]
|
||||
if len(chs) != 1 {
|
||||
t.Fatalf("challenges = %d, want 1", len(chs))
|
||||
}
|
||||
if chs[0].Status != domain.ACMEChallengeStatusValid {
|
||||
t.Errorf("challenge status = %q, want valid (trust_authenticated)", chs[0].Status)
|
||||
}
|
||||
// Audit row written.
|
||||
if got := len(auditRepo.events); got != 1 {
|
||||
t.Errorf("audit events = %d, want 1", got)
|
||||
}
|
||||
if auditRepo.events[0].Action != "acme_order_created" {
|
||||
t.Errorf("audit action = %q", auditRepo.events[0].Action)
|
||||
}
|
||||
if got := svc.Metrics().NewOrderTotal.Load(); got != 1 {
|
||||
t.Errorf("NewOrderTotal = %d, want 1", got)
|
||||
}
|
||||
}
|
||||
|
||||
func TestCreateOrder_ChallengeMode_StaysPending(t *testing.T) {
|
||||
cfg := config.ACMEServerConfig{NonceTTL: 5 * time.Minute, OrderTTL: 24 * time.Hour, AuthzTTL: 24 * time.Hour}
|
||||
repo := newOrderTrackingRepo()
|
||||
pl := &fakeProfileLookup{profiles: map[string]*domain.CertificateProfile{
|
||||
"prof-corp": {ID: "prof-corp", Name: "corp", ACMEAuthMode: "challenge"},
|
||||
}}
|
||||
auditSvc := NewAuditService(&fakeAuditRepo{})
|
||||
svc := NewACMEService(repo, pl, cfg)
|
||||
svc.SetTransactor(&fakeTransactor{})
|
||||
svc.SetAuditService(auditSvc)
|
||||
|
||||
order, err := svc.CreateOrder(context.Background(), "acme-acc-X", "prof-corp",
|
||||
[]domain.ACMEIdentifier{{Type: "dns", Value: "example.com"}}, nil, nil)
|
||||
if err != nil {
|
||||
t.Fatalf("CreateOrder: %v", err)
|
||||
}
|
||||
if order.Status != domain.ACMEOrderStatusPending {
|
||||
t.Errorf("order status = %q, want pending (challenge mode)", order.Status)
|
||||
}
|
||||
authzs := repo.authzs[order.OrderID]
|
||||
if authzs[0].Status != domain.ACMEAuthzStatusPending {
|
||||
t.Errorf("authz status = %q, want pending (challenge mode)", authzs[0].Status)
|
||||
}
|
||||
chs := repo.challenges[authzs[0].AuthzID]
|
||||
if chs[0].Status != domain.ACMEChallengeStatusPending {
|
||||
t.Errorf("challenge status = %q, want pending (challenge mode)", chs[0].Status)
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user