mirror of
https://github.com/shankar0123/certctl.git
synced 2026-06-07 13:51:36 +00:00
acme-server: foundation — directory + new-nonce + per-profile routing (Phase 1a/7)
First slice of the RFC 8555 ACME server endpoint (master plan at cowork/acme-server-endpoint-prompt.md, per-phase prompts at cowork/acme-server-prompts/). This commit lands the smallest viable end-to-end deployable slice: an ACME client running curl -sk https://certctl/acme/profile/<id>/directory curl -sk -I https://certctl/acme/profile/<id>/new-nonce successfully fetches the directory document and a Replay-Nonce. Account creation, JWS verification, orders, challenges, and revocation are all out of scope for this phase and arrive in Phases 1b–4. Closes the Rank 1 LHF from the 2026-05-03 Infisical deep-research (cowork/infisical-deep-research-results.md). Pre-fix, certctl was an ACME consumer only — no /acme/directory endpoint, no JWS verifier, no challenge validators. K8s customers running cert-manager could not point at certctl as an ACME issuer; they had to deploy a certctl agent on every node. What ships: - internal/api/acme/{directory,nonce,errors}.go (+ tests). - internal/api/handler/acme.go + acme_handler_test.go. - internal/repository/postgres/acme.go (nonce ops only — Phase 1b extends with account CRUD; Phases 2-4 extend with order / authz / challenge CRUD). - internal/service/acme.go (BuildDirectory + IssueNonce stubs; Phase 1b adds VerifyJWS / NewAccount / etc.). - migrations/000025_acme_server.{up,down}.sql ships the full 5-table ACME schema (acme_accounts / acme_orders / acme_authorizations / acme_challenges / acme_nonces) PLUS the per-profile certificate_profiles.acme_auth_mode column. Phase 1a actively uses only acme_nonces; remaining tables are empty until Phases 1b-4 plug in. - internal/config/config.go: ACMEServerConfig struct + ACMEServer field on Config. Env vars use CERTCTL_ACME_SERVER_* prefix to avoid colliding with the existing consumer-side ACMEConfig at config.go:1746 (CERTCTL_ACME_DIRECTORY_URL / PROFILE / CHALLENGE_TYPE etc.). Phase 1a wires Enabled + DefaultAuthMode + DefaultProfileID + NonceTTL + DirectoryMeta; Order/Authz TTLs + per-challenge-type concurrency caps + DNS01 resolver are reserved fields parsed in 1a so operators can set them ahead of Phases 2/3. - cmd/server/main.go: wire ACMEHandler into the HandlerRegistry literal alongside the existing certificate / EST / SCEP / etc. handlers. - internal/api/router/router.go: HandlerRegistry.ACME field + 6 Register calls (3 per-profile + 3 shorthand). - internal/api/router/openapi_parity_test.go: 6 new entries in SpecParityExceptions. ACME is a wire-protocol surface (JWS-signed JSON over HTTPS per RFC 7515) whose semantics are dictated by RFC 8555 + RFC 9773 rather than by an OpenAPI document, same precedent as SCEP/EST. The canonical reference is docs/acme-server.md. - docs/acme-server.md: Phase-1a-shaped reference. Configuration table for every CERTCTL_ACME_SERVER_* env var. Per-profile auth-mode decision tree skeleton. TLS trust bootstrap section flagging cert-manager's ClusterIssuer.spec.acme.caBundle requirement (the single biggest first-time-deploy footgun; the full cert-manager walkthrough lands in Phase 6 but the requirement is documented up front). Architecture decisions baked in: - URL family is /acme/profile/<id>/* (per-profile, canonical) with /acme/* shorthand active when CERTCTL_ACME_SERVER_DEFAULT_PROFILE_ID is set. Path matches existing per-profile precedent in EST + SCEP. - Auth mode is per-profile (acme_auth_mode column on certificate_profiles), NOT server-wide. One certctl-server can serve trust_authenticated for an internal-PKI profile and challenge for a public-trust-style profile simultaneously. The column is read at request time, not cached at server start — operators flipping a profile's mode via SQL take effect on the next order without restart. - Nonces are DB-backed (acme_nonces table). Survive server restart. The RFC 8555 §6.5 replay defense requires the store to outlast the client's nonce caching window; an in-memory-only nonce store would lose every in-flight order on restart. - Per-op atomic counters on service.ACMEService.Metrics() — certctl_acme_directory_total, certctl_acme_directory_failures_total, certctl_acme_new_nonce_total, certctl_acme_new_nonce_failures_total. Naming follows certctl frozen decision 0.10 cardinality discipline. Phase 1b will extend with new_account counters; Phase 2 with order / finalize / cert; Phase 3 with per-challenge-type counters. Audit fixes #11 + #12 (cowork/acme-server-prompts/audit-additions.md) applied: - #11: CERTCTL_ACME_SERVER_* prefix avoids the consumer-side CERTCTL_ACME_* namespace collision. - #12: prior-attempt WIP from two failed Phase-1 dispatches was discarded at phase start; this commit starts from a clean tree. Tests: - 14 unit tests in internal/api/acme/ (directory, nonce, errors). - 7 handler-level tests via httptest.NewServer + mockACMEService (mirrors the mockSCEPService pattern at scep_handler_test.go). - 7 service-layer tests with mocked repo + injected profileLookup. - All pass under -race -count=1 -short. Deferred to Phase 1b: - JWS verification (go-jose v4 — see master-prompt §8a for the API surface and audit doc for the speculation pitfalls). - new-account / account/<id> endpoints + AccountService. - Nonce *consumption* path (issue path is in this commit; consume is only invoked by JWS-verified POSTs which Phase 1b adds). Engineering history: cowork/WORKSPACE-CHANGELOG.md "ACME-Server-1a". Per-phase implementation plan: cowork/acme-server-prompts/. Master plan + audit fixes: cowork/acme-server-endpoint-prompt.md + cowork/acme-server-prompt-audit.md + cowork/acme-server-prompts/audit-additions.md.
This commit is contained in:
shankar0123
@@ -0,0 +1,85 @@
|
||||
// Copyright (c) certctl
|
||||
// SPDX-License-Identifier: BSL-1.1
|
||||
|
||||
// Package acme implements the ACME server-side protocol surface (RFC 8555
|
||||
// + RFC 9773 ARI). It is deliberately separate from
|
||||
// internal/connector/issuer/acme/ which is the consumer surface (certctl
|
||||
// talks UP to Let's Encrypt / ZeroSSL / pebble). The two surfaces share
|
||||
// no types — the consumer's data model is client-shaped; the server's
|
||||
// is request-handler-shaped.
|
||||
//
|
||||
// Phase 1a: directory + nonce + JSON-Problem (RFC 7807) error envelopes
|
||||
// only. JWS verification, account resource, orders, challenges, key
|
||||
// rollover, revocation, ARI all land in subsequent phases (1b → 4).
|
||||
package acme
|
||||
|
||||
import "fmt"
|
||||
|
||||
// Directory is the JSON document RFC 8555 §7.1.1 mandates the server
|
||||
// publish at /acme/profile/<id>/directory (and at /acme/directory when
|
||||
// CERTCTL_ACME_SERVER_DEFAULT_PROFILE_ID is set).
|
||||
//
|
||||
// Each URL is the per-profile path the ACME client POSTs against. Even
|
||||
// though Phase 1a only wires up new-nonce, the directory advertises
|
||||
// the full surface — RFC 8555 doesn't permit a partial directory and
|
||||
// clients use the directory's URL fields exclusively (they don't
|
||||
// hand-construct paths from a base URL).
|
||||
type Directory struct {
|
||||
NewNonce string `json:"newNonce"`
|
||||
NewAccount string `json:"newAccount"`
|
||||
NewOrder string `json:"newOrder"`
|
||||
RevokeCert string `json:"revokeCert"`
|
||||
KeyChange string `json:"keyChange"`
|
||||
// RenewalInfo (RFC 9773 ARI) lands in Phase 4. Omitted now via the
|
||||
// `,omitempty` tag so the JSON output stays clean for clients that
|
||||
// don't yet support ARI.
|
||||
RenewalInfo string `json:"renewalInfo,omitempty"`
|
||||
Meta *Meta `json:"meta,omitempty"`
|
||||
}
|
||||
|
||||
// Meta is the optional metadata block per RFC 8555 §7.1.1. Every field
|
||||
// is operator-supplied via CERTCTL_ACME_SERVER_* env vars; an empty
|
||||
// Meta is omitted from the marshaled directory.
|
||||
type Meta struct {
|
||||
TermsOfService string `json:"termsOfService,omitempty"`
|
||||
Website string `json:"website,omitempty"`
|
||||
CAAIdentities []string `json:"caaIdentities,omitempty"`
|
||||
ExternalAccountRequired bool `json:"externalAccountRequired,omitempty"`
|
||||
}
|
||||
|
||||
// BuildDirectory constructs the per-profile directory document.
|
||||
//
|
||||
// baseURL is the per-profile base path (no trailing slash, e.g.
|
||||
// "https://certctl.example.com/acme/profile/prof-corp"). The default-
|
||||
// profile shorthand path passes the same baseURL — clients writing
|
||||
// their config against the shorthand naturally re-derive the per-
|
||||
// profile URLs from the directory.
|
||||
//
|
||||
// All five canonical RFC 8555 endpoints are populated; renewalInfo is
|
||||
// populated only when ARIEnabled=true so Phase 1a (where ARI is
|
||||
// non-functional) doesn't advertise a 404-returning URL. ARI flips on
|
||||
// in Phase 4 along with the actual handler.
|
||||
func BuildDirectory(baseURL, tos, website string, caa []string, eabRequired, ariEnabled bool) *Directory {
|
||||
dir := &Directory{
|
||||
NewNonce: fmt.Sprintf("%s/new-nonce", baseURL),
|
||||
NewAccount: fmt.Sprintf("%s/new-account", baseURL),
|
||||
NewOrder: fmt.Sprintf("%s/new-order", baseURL),
|
||||
RevokeCert: fmt.Sprintf("%s/revoke-cert", baseURL),
|
||||
KeyChange: fmt.Sprintf("%s/key-change", baseURL),
|
||||
}
|
||||
if ariEnabled {
|
||||
// RFC 9773 §4.1 publishes ARI as `renewalInfo`. Phase 4 wires
|
||||
// the actual handler; until then, BuildDirectory callers pass
|
||||
// ariEnabled=false.
|
||||
dir.RenewalInfo = fmt.Sprintf("%s/renewal-info", baseURL)
|
||||
}
|
||||
if tos != "" || website != "" || len(caa) > 0 || eabRequired {
|
||||
dir.Meta = &Meta{
|
||||
TermsOfService: tos,
|
||||
Website: website,
|
||||
CAAIdentities: caa,
|
||||
ExternalAccountRequired: eabRequired,
|
||||
}
|
||||
}
|
||||
return dir
|
||||
}
|
||||
@@ -0,0 +1,113 @@
|
||||
// Copyright (c) certctl
|
||||
// SPDX-License-Identifier: BSL-1.1
|
||||
|
||||
package acme
|
||||
|
||||
import (
|
||||
"encoding/json"
|
||||
"strings"
|
||||
"testing"
|
||||
)
|
||||
|
||||
func TestBuildDirectory_FullMeta(t *testing.T) {
|
||||
d := BuildDirectory(
|
||||
"https://server/acme/profile/prof-corp",
|
||||
"https://example.com/tos",
|
||||
"https://example.com",
|
||||
[]string{"example.com"},
|
||||
true,
|
||||
false,
|
||||
)
|
||||
if got, want := d.NewNonce, "https://server/acme/profile/prof-corp/new-nonce"; got != want {
|
||||
t.Errorf("NewNonce = %q, want %q", got, want)
|
||||
}
|
||||
if got, want := d.NewAccount, "https://server/acme/profile/prof-corp/new-account"; got != want {
|
||||
t.Errorf("NewAccount = %q, want %q", got, want)
|
||||
}
|
||||
if got, want := d.NewOrder, "https://server/acme/profile/prof-corp/new-order"; got != want {
|
||||
t.Errorf("NewOrder = %q, want %q", got, want)
|
||||
}
|
||||
if got, want := d.RevokeCert, "https://server/acme/profile/prof-corp/revoke-cert"; got != want {
|
||||
t.Errorf("RevokeCert = %q, want %q", got, want)
|
||||
}
|
||||
if got, want := d.KeyChange, "https://server/acme/profile/prof-corp/key-change"; got != want {
|
||||
t.Errorf("KeyChange = %q, want %q", got, want)
|
||||
}
|
||||
if d.RenewalInfo != "" {
|
||||
t.Errorf("RenewalInfo should be empty when ariEnabled=false; got %q", d.RenewalInfo)
|
||||
}
|
||||
if d.Meta == nil {
|
||||
t.Fatal("Meta should be populated when any meta field is set")
|
||||
}
|
||||
if d.Meta.TermsOfService != "https://example.com/tos" {
|
||||
t.Errorf("TermsOfService = %q", d.Meta.TermsOfService)
|
||||
}
|
||||
if d.Meta.Website != "https://example.com" {
|
||||
t.Errorf("Website = %q", d.Meta.Website)
|
||||
}
|
||||
if !d.Meta.ExternalAccountRequired {
|
||||
t.Error("ExternalAccountRequired should be true")
|
||||
}
|
||||
if len(d.Meta.CAAIdentities) != 1 || d.Meta.CAAIdentities[0] != "example.com" {
|
||||
t.Errorf("CAAIdentities = %v", d.Meta.CAAIdentities)
|
||||
}
|
||||
}
|
||||
|
||||
func TestBuildDirectory_NoMeta(t *testing.T) {
|
||||
d := BuildDirectory("https://server/acme/profile/prof-corp", "", "", nil, false, false)
|
||||
if d.Meta != nil {
|
||||
t.Errorf("Meta should be nil when all meta fields zero; got %+v", d.Meta)
|
||||
}
|
||||
}
|
||||
|
||||
func TestBuildDirectory_EABRequiredOnly(t *testing.T) {
|
||||
d := BuildDirectory("https://server/acme/profile/prof-corp", "", "", nil, true, false)
|
||||
if d.Meta == nil {
|
||||
t.Fatal("Meta should be populated when EAB is required")
|
||||
}
|
||||
if !d.Meta.ExternalAccountRequired {
|
||||
t.Error("ExternalAccountRequired should be true")
|
||||
}
|
||||
if d.Meta.TermsOfService != "" || d.Meta.Website != "" || len(d.Meta.CAAIdentities) != 0 {
|
||||
t.Errorf("only EAB should be set; meta = %+v", d.Meta)
|
||||
}
|
||||
}
|
||||
|
||||
func TestBuildDirectory_ARIEnabled(t *testing.T) {
|
||||
d := BuildDirectory("https://server/acme/profile/prof-corp", "", "", nil, false, true)
|
||||
if d.RenewalInfo == "" {
|
||||
t.Fatal("RenewalInfo should be populated when ariEnabled=true")
|
||||
}
|
||||
if !strings.HasSuffix(d.RenewalInfo, "/renewal-info") {
|
||||
t.Errorf("RenewalInfo = %q; expected suffix /renewal-info", d.RenewalInfo)
|
||||
}
|
||||
}
|
||||
|
||||
func TestBuildDirectory_JSONShape(t *testing.T) {
|
||||
// RFC 8555 §7.1.1 dictates the JSON field names. A regression here
|
||||
// would break every ACME client.
|
||||
d := BuildDirectory("https://server/acme/profile/prof-corp", "", "", nil, false, false)
|
||||
b, err := json.Marshal(d)
|
||||
if err != nil {
|
||||
t.Fatalf("Marshal: %v", err)
|
||||
}
|
||||
got := string(b)
|
||||
for _, want := range []string{
|
||||
`"newNonce":"https://server/acme/profile/prof-corp/new-nonce"`,
|
||||
`"newAccount":"https://server/acme/profile/prof-corp/new-account"`,
|
||||
`"newOrder":"https://server/acme/profile/prof-corp/new-order"`,
|
||||
`"revokeCert":"https://server/acme/profile/prof-corp/revoke-cert"`,
|
||||
`"keyChange":"https://server/acme/profile/prof-corp/key-change"`,
|
||||
} {
|
||||
if !strings.Contains(got, want) {
|
||||
t.Errorf("JSON missing %q\nGot: %s", want, got)
|
||||
}
|
||||
}
|
||||
// renewalInfo + meta should be omitted.
|
||||
if strings.Contains(got, "renewalInfo") {
|
||||
t.Errorf("renewalInfo should be omitted when ARI disabled; got %s", got)
|
||||
}
|
||||
if strings.Contains(got, `"meta"`) {
|
||||
t.Errorf("meta should be omitted when no fields set; got %s", got)
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,127 @@
|
||||
// Copyright (c) certctl
|
||||
// SPDX-License-Identifier: BSL-1.1
|
||||
|
||||
package acme
|
||||
|
||||
import (
|
||||
"encoding/json"
|
||||
"net/http"
|
||||
)
|
||||
|
||||
// ProblemContentType is the MIME type RFC 7807 §3 mandates for the
|
||||
// JSON-Problem error envelope. ACME inherits this from RFC 8555 §6.7.
|
||||
const ProblemContentType = "application/problem+json"
|
||||
|
||||
// ACME error type URN prefix per RFC 8555 §6.7.
|
||||
const acmeErrorPrefix = "urn:ietf:params:acme:error:"
|
||||
|
||||
// Problem is the RFC 7807 Problem Details document. ACME extends it
|
||||
// per RFC 8555 §6.7 with subproblems (per-identifier-rejection
|
||||
// breakdowns) and identifier (the failing identifier on
|
||||
// rejectedIdentifier). Both extension fields land in Phase 2 along
|
||||
// with the order endpoints; Phase 1a only emits the base shape.
|
||||
type Problem struct {
|
||||
Type string `json:"type"`
|
||||
Detail string `json:"detail"`
|
||||
Status int `json:"status"`
|
||||
Subproblems []Problem `json:"subproblems,omitempty"`
|
||||
Identifier *Identifier `json:"identifier,omitempty"`
|
||||
}
|
||||
|
||||
// Identifier is the ACME identifier shape (RFC 8555 §7.4). Defined here
|
||||
// (rather than in a Phase-2-only file) so Phase 1a's Problem struct can
|
||||
// reference *Identifier without a forward-package-dependency.
|
||||
type Identifier struct {
|
||||
Type string `json:"type"`
|
||||
Value string `json:"value"`
|
||||
}
|
||||
|
||||
// Malformed is RFC 8555 §6.7's "request body did not parse / decode" /
|
||||
// "the JWS was malformed" / "payload JSON was malformed" error. HTTP
|
||||
// status 400.
|
||||
func Malformed(detail string) Problem {
|
||||
return Problem{
|
||||
Type: acmeErrorPrefix + "malformed",
|
||||
Detail: detail,
|
||||
Status: http.StatusBadRequest,
|
||||
}
|
||||
}
|
||||
|
||||
// ServerInternal is the catch-all for unexpected server-side errors.
|
||||
// HTTP status 500. The detail string is operator-facing; per the
|
||||
// master prompt's acquisition-readiness criterion #10 it MUST NOT
|
||||
// echo SQL errors, internal trace IDs, or credential bytes.
|
||||
func ServerInternal(detail string) Problem {
|
||||
return Problem{
|
||||
Type: acmeErrorPrefix + "serverInternal",
|
||||
Detail: detail,
|
||||
Status: http.StatusInternalServerError,
|
||||
}
|
||||
}
|
||||
|
||||
// UserActionRequired is RFC 8555 §6.7's "the user has to do something
|
||||
// out of band before this request will succeed" error. We return it
|
||||
// from the /acme/* shorthand path family when
|
||||
// CERTCTL_ACME_SERVER_DEFAULT_PROFILE_ID is not set — the operator
|
||||
// has to either set the env var or update the client to use
|
||||
// /acme/profile/<id>/*. HTTP status 403 per RFC 8555.
|
||||
func UserActionRequired(detail string) Problem {
|
||||
return Problem{
|
||||
Type: acmeErrorPrefix + "userActionRequired",
|
||||
Detail: detail,
|
||||
Status: http.StatusForbidden,
|
||||
}
|
||||
}
|
||||
|
||||
// UnsupportedContentType is RFC 7807-shaped (no ACME error type) for
|
||||
// requests with a Content-Type the endpoint doesn't accept. Phase 1b
|
||||
// will switch the JWS endpoints to require
|
||||
// "application/jose+json" specifically; Phase 1a's directory + nonce
|
||||
// have no Content-Type requirements and never emit this.
|
||||
func UnsupportedContentType(got string) Problem {
|
||||
return Problem{
|
||||
Type: "about:blank",
|
||||
Detail: "unsupported content type: " + got,
|
||||
Status: http.StatusUnsupportedMediaType,
|
||||
}
|
||||
}
|
||||
|
||||
// AccountDoesNotExist (RFC 8555 §7.3.1) is what the JWS verifier returns
|
||||
// when the request's `kid` points at an unknown account. Phase 1b
|
||||
// implements the verifier; this shape is exposed in Phase 1a for the
|
||||
// errors_test.go round-trip cases.
|
||||
func AccountDoesNotExist(detail string) Problem {
|
||||
return Problem{
|
||||
Type: acmeErrorPrefix + "accountDoesNotExist",
|
||||
Detail: detail,
|
||||
Status: http.StatusBadRequest,
|
||||
}
|
||||
}
|
||||
|
||||
// BadNonce is what the JWS verifier returns on a missing / replayed /
|
||||
// expired nonce per RFC 8555 §6.5.1. Phase 1b wires the verifier;
|
||||
// shape exposed now so errors_test.go can round-trip it.
|
||||
func BadNonce(detail string) Problem {
|
||||
return Problem{
|
||||
Type: acmeErrorPrefix + "badNonce",
|
||||
Detail: detail,
|
||||
Status: http.StatusBadRequest,
|
||||
}
|
||||
}
|
||||
|
||||
// WriteProblem renders a Problem as RFC 7807 JSON to w, with the
|
||||
// appropriate Content-Type and status. Any nil-Problem is rendered as
|
||||
// 500 + serverInternal so the handler never panics on a forgotten
|
||||
// error path.
|
||||
func WriteProblem(w http.ResponseWriter, p Problem) {
|
||||
if p.Status == 0 {
|
||||
p = ServerInternal("unspecified error")
|
||||
}
|
||||
w.Header().Set("Content-Type", ProblemContentType)
|
||||
w.WriteHeader(p.Status)
|
||||
// Marshaling can only fail on un-encodable types; Problem only
|
||||
// uses primitives + slices so json.Marshal cannot fail. The
|
||||
// _ = ... discard mirrors how response.go handles json.Encoder
|
||||
// errors.
|
||||
_ = json.NewEncoder(w).Encode(p)
|
||||
}
|
||||
@@ -0,0 +1,106 @@
|
||||
// Copyright (c) certctl
|
||||
// SPDX-License-Identifier: BSL-1.1
|
||||
|
||||
package acme
|
||||
|
||||
import (
|
||||
"encoding/json"
|
||||
"net/http"
|
||||
"net/http/httptest"
|
||||
"strings"
|
||||
"testing"
|
||||
)
|
||||
|
||||
func TestProblem_Malformed_Shape(t *testing.T) {
|
||||
p := Malformed("payload was not valid JSON")
|
||||
if p.Status != http.StatusBadRequest {
|
||||
t.Errorf("status = %d, want %d", p.Status, http.StatusBadRequest)
|
||||
}
|
||||
if p.Type != "urn:ietf:params:acme:error:malformed" {
|
||||
t.Errorf("type = %q", p.Type)
|
||||
}
|
||||
if p.Detail != "payload was not valid JSON" {
|
||||
t.Errorf("detail = %q", p.Detail)
|
||||
}
|
||||
// Subproblems and Identifier are Phase-2 extensions; both stay empty
|
||||
// for a Phase-1a-emitted problem.
|
||||
if len(p.Subproblems) != 0 {
|
||||
t.Errorf("subproblems should be empty; got %v", p.Subproblems)
|
||||
}
|
||||
if p.Identifier != nil {
|
||||
t.Errorf("identifier should be nil; got %+v", p.Identifier)
|
||||
}
|
||||
}
|
||||
|
||||
func TestProblem_AllHelperShapes(t *testing.T) {
|
||||
cases := []struct {
|
||||
name string
|
||||
p Problem
|
||||
wantType string
|
||||
wantStatus int
|
||||
}{
|
||||
{"Malformed", Malformed("x"), "urn:ietf:params:acme:error:malformed", http.StatusBadRequest},
|
||||
{"ServerInternal", ServerInternal("x"), "urn:ietf:params:acme:error:serverInternal", http.StatusInternalServerError},
|
||||
{"UserActionRequired", UserActionRequired("x"), "urn:ietf:params:acme:error:userActionRequired", http.StatusForbidden},
|
||||
{"AccountDoesNotExist", AccountDoesNotExist("x"), "urn:ietf:params:acme:error:accountDoesNotExist", http.StatusBadRequest},
|
||||
{"BadNonce", BadNonce("x"), "urn:ietf:params:acme:error:badNonce", http.StatusBadRequest},
|
||||
}
|
||||
for _, tc := range cases {
|
||||
t.Run(tc.name, func(t *testing.T) {
|
||||
if tc.p.Type != tc.wantType {
|
||||
t.Errorf("type = %q, want %q", tc.p.Type, tc.wantType)
|
||||
}
|
||||
if tc.p.Status != tc.wantStatus {
|
||||
t.Errorf("status = %d, want %d", tc.p.Status, tc.wantStatus)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestProblem_UnsupportedContentType(t *testing.T) {
|
||||
p := UnsupportedContentType("application/json")
|
||||
if p.Status != http.StatusUnsupportedMediaType {
|
||||
t.Errorf("status = %d, want 415", p.Status)
|
||||
}
|
||||
if p.Type != "about:blank" {
|
||||
t.Errorf("UnsupportedContentType uses RFC 7807 about:blank; got %q", p.Type)
|
||||
}
|
||||
if !strings.Contains(p.Detail, "application/json") {
|
||||
t.Errorf("detail should echo content-type; got %q", p.Detail)
|
||||
}
|
||||
}
|
||||
|
||||
func TestWriteProblem_Headers(t *testing.T) {
|
||||
rec := httptest.NewRecorder()
|
||||
WriteProblem(rec, Malformed("oops"))
|
||||
|
||||
if got, want := rec.Code, http.StatusBadRequest; got != want {
|
||||
t.Errorf("status = %d, want %d", got, want)
|
||||
}
|
||||
if got, want := rec.Header().Get("Content-Type"), ProblemContentType; got != want {
|
||||
t.Errorf("content-type = %q, want %q", got, want)
|
||||
}
|
||||
|
||||
var p Problem
|
||||
if err := json.NewDecoder(rec.Body).Decode(&p); err != nil {
|
||||
t.Fatalf("Decode: %v", err)
|
||||
}
|
||||
if p.Type != "urn:ietf:params:acme:error:malformed" {
|
||||
t.Errorf("decoded type = %q", p.Type)
|
||||
}
|
||||
}
|
||||
|
||||
func TestWriteProblem_NilStatusFallsBackTo500(t *testing.T) {
|
||||
// Defensive check: a hand-constructed Problem with Status=0 (e.g.
|
||||
// from a forgotten error path) still renders cleanly as 500 +
|
||||
// serverInternal rather than emitting an HTTP/0 response.
|
||||
rec := httptest.NewRecorder()
|
||||
WriteProblem(rec, Problem{})
|
||||
|
||||
if got, want := rec.Code, http.StatusInternalServerError; got != want {
|
||||
t.Errorf("status = %d, want %d", got, want)
|
||||
}
|
||||
if got, want := rec.Header().Get("Content-Type"), ProblemContentType; got != want {
|
||||
t.Errorf("content-type = %q, want %q", got, want)
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,47 @@
|
||||
// Copyright (c) certctl
|
||||
// SPDX-License-Identifier: BSL-1.1
|
||||
|
||||
package acme
|
||||
|
||||
import (
|
||||
"context"
|
||||
"crypto/rand"
|
||||
"encoding/base64"
|
||||
"time"
|
||||
)
|
||||
|
||||
// NonceStore is the persistence-layer contract for ACME nonces. The
|
||||
// production implementation lives at internal/repository/postgres/acme.go
|
||||
// and is DB-backed (NOT in-memory) — replay protection requires the
|
||||
// store to outlast the client's nonce caching window.
|
||||
//
|
||||
// Issue creates a new nonce and stores it with a TTL. The string return
|
||||
// is what the handler echoes in the Replay-Nonce response header.
|
||||
//
|
||||
// Consume marks a nonce used and returns an error if the nonce is
|
||||
// missing, already used, or expired. The handler maps that error to
|
||||
// urn:ietf:params:acme:error:badNonce per RFC 8555 §6.5.1.
|
||||
//
|
||||
// Phase 1a: Issue is wired (every directory + new-nonce response carries
|
||||
// a Replay-Nonce header). Consume is exposed but not yet invoked —
|
||||
// JWS-authenticated POSTs (which consume nonces) arrive in Phase 1b.
|
||||
type NonceStore interface {
|
||||
Issue(ctx context.Context, ttl time.Duration) (string, error)
|
||||
Consume(ctx context.Context, nonce string) error
|
||||
}
|
||||
|
||||
// nonceByteLen is 32 bytes (256 bits) of entropy. RFC 8555 §6.5.1 only
|
||||
// requires nonces to be hard-to-guess; 256 bits is overkill on purpose
|
||||
// (matches the consumer-side ACME library + every other ACME server).
|
||||
const nonceByteLen = 32
|
||||
|
||||
// GenerateNonce returns 32 cryptographically-random bytes encoded as
|
||||
// base64url-no-padding per RFC 7515 §2 (the encoding ACME wire format
|
||||
// uses for the protected-header nonce field).
|
||||
func GenerateNonce() (string, error) {
|
||||
b := make([]byte, nonceByteLen)
|
||||
if _, err := rand.Read(b); err != nil {
|
||||
return "", err
|
||||
}
|
||||
return base64.RawURLEncoding.EncodeToString(b), nil
|
||||
}
|
||||
@@ -0,0 +1,46 @@
|
||||
// Copyright (c) certctl
|
||||
// SPDX-License-Identifier: BSL-1.1
|
||||
|
||||
package acme
|
||||
|
||||
import (
|
||||
"encoding/base64"
|
||||
"testing"
|
||||
)
|
||||
|
||||
func TestGenerateNonce_LengthAndCharset(t *testing.T) {
|
||||
n, err := GenerateNonce()
|
||||
if err != nil {
|
||||
t.Fatalf("GenerateNonce: %v", err)
|
||||
}
|
||||
// base64.RawURLEncoding emits ceil(N*8/6) chars = ceil(32*8/6) = 43.
|
||||
if got, want := len(n), 43; got != want {
|
||||
t.Errorf("nonce length = %d, want %d", got, want)
|
||||
}
|
||||
// Charset must decode under base64url-no-padding.
|
||||
raw, err := base64.RawURLEncoding.DecodeString(n)
|
||||
if err != nil {
|
||||
t.Fatalf("nonce did not decode under base64url-no-padding: %v", err)
|
||||
}
|
||||
if len(raw) != nonceByteLen {
|
||||
t.Errorf("decoded nonce = %d bytes, want %d", len(raw), nonceByteLen)
|
||||
}
|
||||
}
|
||||
|
||||
func TestGenerateNonce_Distinct(t *testing.T) {
|
||||
// Statistical sanity check, NOT cryptographic strength proof.
|
||||
// 256 bits of entropy means the probability of two consecutive
|
||||
// values colliding is ~2^-256 — well below the threshold for a
|
||||
// flaky-test-on-the-cosmos timeline.
|
||||
a, err := GenerateNonce()
|
||||
if err != nil {
|
||||
t.Fatalf("GenerateNonce a: %v", err)
|
||||
}
|
||||
b, err := GenerateNonce()
|
||||
if err != nil {
|
||||
t.Fatalf("GenerateNonce b: %v", err)
|
||||
}
|
||||
if a == b {
|
||||
t.Errorf("two consecutive nonces collided: %q", a)
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,170 @@
|
||||
// Copyright (c) certctl
|
||||
// SPDX-License-Identifier: BSL-1.1
|
||||
|
||||
package handler
|
||||
|
||||
import (
|
||||
"context"
|
||||
"encoding/json"
|
||||
"errors"
|
||||
"net/http"
|
||||
|
||||
"github.com/shankar0123/certctl/internal/api/acme"
|
||||
"github.com/shankar0123/certctl/internal/service"
|
||||
)
|
||||
|
||||
// ACMEService is the handler-facing surface for the ACME server. The
|
||||
// service-layer concrete type is *service.ACMEService; the interface
|
||||
// definition lives here to keep the handler import-direction
|
||||
// canonical (handler imports service, not the reverse). Phase 1a
|
||||
// pins two methods; Phase 1b extends with VerifyJWS, NewAccount,
|
||||
// LookupAccount, UpdateAccount, DeactivateAccount.
|
||||
type ACMEService interface {
|
||||
BuildDirectory(ctx context.Context, profileID, baseURL string) (*acme.Directory, error)
|
||||
IssueNonce(ctx context.Context) (string, error)
|
||||
}
|
||||
|
||||
// ACMEHandler exposes the ACME server's RFC 8555 endpoints under the
|
||||
// per-profile path /acme/profile/<id>/* and (optionally) the
|
||||
// /acme/* shorthand when CERTCTL_ACME_SERVER_DEFAULT_PROFILE_ID is
|
||||
// set. Phase 1a wires:
|
||||
//
|
||||
// - GET /acme/profile/{id}/directory
|
||||
// - HEAD /acme/profile/{id}/new-nonce
|
||||
// - GET /acme/profile/{id}/new-nonce
|
||||
// - GET /acme/directory (shorthand)
|
||||
// - HEAD /acme/new-nonce (shorthand)
|
||||
// - GET /acme/new-nonce (shorthand)
|
||||
//
|
||||
// Phase 1b adds new-account + account/<id>; Phase 2 adds new-order +
|
||||
// order/<id>(/finalize) + authz/<id> + cert/<id>; Phase 3 adds
|
||||
// challenge/<id>; Phase 4 adds key-change + revoke-cert + renewal-info.
|
||||
//
|
||||
// Handler shape mirrors internal/api/handler/scep.go:73-91 (struct
|
||||
// holding the service interface, factory function returning the
|
||||
// struct value).
|
||||
type ACMEHandler struct {
|
||||
svc ACMEService
|
||||
}
|
||||
|
||||
// NewACMEHandler constructs an ACMEHandler. Returns the value (not a
|
||||
// pointer) — same convention as NewSCEPHandler at scep.go:89.
|
||||
func NewACMEHandler(svc ACMEService) ACMEHandler {
|
||||
return ACMEHandler{svc: svc}
|
||||
}
|
||||
|
||||
// Directory handles GET requests to the directory URL. The Go 1.22+
|
||||
// stdlib router parses the {id} path parameter via r.PathValue("id").
|
||||
// When the path is /acme/directory (no profile in URL), PathValue
|
||||
// returns ""; the service layer applies the
|
||||
// CERTCTL_ACME_SERVER_DEFAULT_PROFILE_ID fallback (or returns
|
||||
// userActionRequired if unset).
|
||||
func (h ACMEHandler) Directory(w http.ResponseWriter, r *http.Request) {
|
||||
profileID := r.PathValue("id")
|
||||
baseURL := h.directoryBaseURL(r, profileID)
|
||||
|
||||
dir, err := h.svc.BuildDirectory(r.Context(), profileID, baseURL)
|
||||
if err != nil {
|
||||
writeServiceError(w, err)
|
||||
return
|
||||
}
|
||||
|
||||
// RFC 8555 §6.5: every successful response carries Replay-Nonce.
|
||||
// The directory endpoint is not JWS-authenticated but ACME clients
|
||||
// expect the header so they can use it on the very next POST.
|
||||
if nonce, err := h.svc.IssueNonce(r.Context()); err == nil {
|
||||
w.Header().Set("Replay-Nonce", nonce)
|
||||
}
|
||||
w.Header().Set("Cache-Control", "public, max-age=0, no-cache")
|
||||
w.Header().Set("Content-Type", "application/json")
|
||||
_ = json.NewEncoder(w).Encode(dir)
|
||||
}
|
||||
|
||||
// NewNonce handles HEAD and GET on the new-nonce URL.
|
||||
//
|
||||
// RFC 8555 §7.2:
|
||||
// - HEAD MUST return 200 with Replay-Nonce + zero-length body.
|
||||
// - GET MUST return 204 No Content with Replay-Nonce + zero-length body.
|
||||
//
|
||||
// Both verbs MUST set Cache-Control: no-store so middleboxes don't
|
||||
// inadvertently re-serve a stale nonce.
|
||||
//
|
||||
// We resolve the profile here (rather than passing it through the
|
||||
// service) only to validate it exists — the nonce itself is global
|
||||
// to the server (one acme_nonces table), but if the operator hits
|
||||
// /acme/profile/<bogus>/new-nonce we return 404 so the path-shape
|
||||
// failure is operator-visible.
|
||||
func (h ACMEHandler) NewNonce(w http.ResponseWriter, r *http.Request) {
|
||||
profileID := r.PathValue("id")
|
||||
// Same profile-resolution path as Directory — go through
|
||||
// BuildDirectory only to leverage its profile-not-found / user-
|
||||
// action-required mapping. The directory document is not used.
|
||||
baseURL := h.directoryBaseURL(r, profileID)
|
||||
if _, err := h.svc.BuildDirectory(r.Context(), profileID, baseURL); err != nil {
|
||||
writeServiceError(w, err)
|
||||
return
|
||||
}
|
||||
|
||||
nonce, err := h.svc.IssueNonce(r.Context())
|
||||
if err != nil {
|
||||
acme.WriteProblem(w, acme.ServerInternal("nonce issuance failed"))
|
||||
return
|
||||
}
|
||||
|
||||
w.Header().Set("Replay-Nonce", nonce)
|
||||
w.Header().Set("Cache-Control", "no-store")
|
||||
if r.Method == http.MethodHead {
|
||||
w.WriteHeader(http.StatusOK)
|
||||
return
|
||||
}
|
||||
w.WriteHeader(http.StatusNoContent)
|
||||
}
|
||||
|
||||
// directoryBaseURL composes the per-profile base URL the directory's
|
||||
// inner URLs are built against. The composition lives in the handler
|
||||
// (NOT the service) because it depends on the inbound request's
|
||||
// scheme + host + observed path; the service layer would need to
|
||||
// import net/http to do this.
|
||||
//
|
||||
// For requests on /acme/profile/<id>/* we strip the trailing path
|
||||
// element to produce the base. For shorthand /acme/* requests we
|
||||
// strip the trailing element from /acme — the result is just the
|
||||
// scheme://host/acme prefix, which the service then uses to build
|
||||
// /acme/new-nonce, /acme/new-account, etc.
|
||||
func (h ACMEHandler) directoryBaseURL(r *http.Request, profileID string) string {
|
||||
scheme := "https"
|
||||
if r.TLS == nil {
|
||||
// HTTPS-only architecture decision (CLAUDE.md): the listener
|
||||
// is TLS 1.3 pinned. r.TLS == nil only happens in tests with
|
||||
// httptest.NewServer (non-TLS); honor http: for those.
|
||||
scheme = "http"
|
||||
}
|
||||
if profileID != "" {
|
||||
return scheme + "://" + r.Host + "/acme/profile/" + profileID
|
||||
}
|
||||
return scheme + "://" + r.Host + "/acme"
|
||||
}
|
||||
|
||||
// writeServiceError maps service-layer sentinels to RFC 7807 + RFC
|
||||
// 8555 §6.7 problem responses. Centralized so every handler method
|
||||
// gets identical mapping; future Phase 1b/2/3/4 sentinels extend
|
||||
// the switch.
|
||||
func writeServiceError(w http.ResponseWriter, err error) {
|
||||
switch {
|
||||
case errors.Is(err, service.ErrACMEUserActionRequired):
|
||||
acme.WriteProblem(w, acme.UserActionRequired(
|
||||
"this server requires the per-profile path /acme/profile/<id>/* — "+
|
||||
"set CERTCTL_ACME_SERVER_DEFAULT_PROFILE_ID for /acme/* shorthand"))
|
||||
case errors.Is(err, service.ErrACMEProfileNotFound):
|
||||
acme.WriteProblem(w, acme.Problem{
|
||||
Type: "urn:ietf:params:acme:error:userActionRequired",
|
||||
Detail: "profile not found",
|
||||
Status: http.StatusNotFound,
|
||||
})
|
||||
default:
|
||||
// Avoid leaking internal error text per master-prompt
|
||||
// criterion #10 (operator-actionable errors with no info
|
||||
// leak). The detail is operator-facing but generic.
|
||||
acme.WriteProblem(w, acme.ServerInternal("ACME server error"))
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,242 @@
|
||||
// Copyright (c) certctl
|
||||
// SPDX-License-Identifier: BSL-1.1
|
||||
|
||||
package handler
|
||||
|
||||
import (
|
||||
"context"
|
||||
"encoding/json"
|
||||
"errors"
|
||||
"net/http"
|
||||
"net/http/httptest"
|
||||
"strings"
|
||||
"testing"
|
||||
|
||||
"github.com/shankar0123/certctl/internal/api/acme"
|
||||
"github.com/shankar0123/certctl/internal/service"
|
||||
)
|
||||
|
||||
// mockACMEService implements ACMEService for handler-level tests.
|
||||
// Mirrors the mockSCEPService pattern at scep_handler_test.go (struct
|
||||
// holding canned responses + an err field per method).
|
||||
type mockACMEService struct {
|
||||
BuildDirectoryFn func(ctx context.Context, profileID, baseURL string) (*acme.Directory, error)
|
||||
IssueNonceFn func(ctx context.Context) (string, error)
|
||||
}
|
||||
|
||||
func (m *mockACMEService) BuildDirectory(ctx context.Context, profileID, baseURL string) (*acme.Directory, error) {
|
||||
if m.BuildDirectoryFn != nil {
|
||||
return m.BuildDirectoryFn(ctx, profileID, baseURL)
|
||||
}
|
||||
return acme.BuildDirectory(baseURL, "", "", nil, false, false), nil
|
||||
}
|
||||
|
||||
func (m *mockACMEService) IssueNonce(ctx context.Context) (string, error) {
|
||||
if m.IssueNonceFn != nil {
|
||||
return m.IssueNonceFn(ctx)
|
||||
}
|
||||
return "test-nonce-12345", nil
|
||||
}
|
||||
|
||||
// newACMETestServer wires the ACMEHandler against the mock + a stdlib
|
||||
// ServeMux configured exactly the way internal/api/router/router.go
|
||||
// does it in production. Routes:
|
||||
//
|
||||
// GET /acme/profile/{id}/directory
|
||||
// HEAD /acme/profile/{id}/new-nonce
|
||||
// GET /acme/profile/{id}/new-nonce
|
||||
// GET /acme/directory (shorthand)
|
||||
// HEAD /acme/new-nonce (shorthand)
|
||||
// GET /acme/new-nonce (shorthand)
|
||||
func newACMETestServer(t *testing.T, mock *mockACMEService) *httptest.Server {
|
||||
t.Helper()
|
||||
h := NewACMEHandler(mock)
|
||||
mux := http.NewServeMux()
|
||||
mux.HandleFunc("GET /acme/profile/{id}/directory", h.Directory)
|
||||
mux.HandleFunc("HEAD /acme/profile/{id}/new-nonce", h.NewNonce)
|
||||
mux.HandleFunc("GET /acme/profile/{id}/new-nonce", h.NewNonce)
|
||||
mux.HandleFunc("GET /acme/directory", h.Directory)
|
||||
mux.HandleFunc("HEAD /acme/new-nonce", h.NewNonce)
|
||||
mux.HandleFunc("GET /acme/new-nonce", h.NewNonce)
|
||||
return httptest.NewServer(mux)
|
||||
}
|
||||
|
||||
func TestACMEHandler_Directory_HappyPath(t *testing.T) {
|
||||
mock := &mockACMEService{}
|
||||
srv := newACMETestServer(t, mock)
|
||||
defer srv.Close()
|
||||
|
||||
resp, err := http.Get(srv.URL + "/acme/profile/prof-corp/directory")
|
||||
if err != nil {
|
||||
t.Fatalf("Get: %v", err)
|
||||
}
|
||||
defer resp.Body.Close()
|
||||
|
||||
if resp.StatusCode != http.StatusOK {
|
||||
t.Errorf("status = %d, want 200", resp.StatusCode)
|
||||
}
|
||||
if got := resp.Header.Get("Content-Type"); got != "application/json" {
|
||||
t.Errorf("content-type = %q", got)
|
||||
}
|
||||
if got := resp.Header.Get("Replay-Nonce"); got == "" {
|
||||
t.Error("Replay-Nonce header missing on directory response")
|
||||
}
|
||||
|
||||
var dir acme.Directory
|
||||
if err := json.NewDecoder(resp.Body).Decode(&dir); err != nil {
|
||||
t.Fatalf("Decode: %v", err)
|
||||
}
|
||||
if !strings.Contains(dir.NewNonce, "/acme/profile/prof-corp/new-nonce") {
|
||||
t.Errorf("NewNonce = %q", dir.NewNonce)
|
||||
}
|
||||
}
|
||||
|
||||
func TestACMEHandler_Directory_UnknownProfile(t *testing.T) {
|
||||
mock := &mockACMEService{
|
||||
BuildDirectoryFn: func(ctx context.Context, profileID, baseURL string) (*acme.Directory, error) {
|
||||
return nil, service.ErrACMEProfileNotFound
|
||||
},
|
||||
}
|
||||
srv := newACMETestServer(t, mock)
|
||||
defer srv.Close()
|
||||
|
||||
resp, err := http.Get(srv.URL + "/acme/profile/missing/directory")
|
||||
if err != nil {
|
||||
t.Fatalf("Get: %v", err)
|
||||
}
|
||||
defer resp.Body.Close()
|
||||
|
||||
if resp.StatusCode != http.StatusNotFound {
|
||||
t.Errorf("status = %d, want 404", resp.StatusCode)
|
||||
}
|
||||
if got := resp.Header.Get("Content-Type"); got != acme.ProblemContentType {
|
||||
t.Errorf("content-type = %q, want %q", got, acme.ProblemContentType)
|
||||
}
|
||||
}
|
||||
|
||||
func TestACMEHandler_NewNonce_HEAD(t *testing.T) {
|
||||
mock := &mockACMEService{}
|
||||
srv := newACMETestServer(t, mock)
|
||||
defer srv.Close()
|
||||
|
||||
req, _ := http.NewRequest(http.MethodHead, srv.URL+"/acme/profile/prof-corp/new-nonce", nil)
|
||||
resp, err := http.DefaultClient.Do(req)
|
||||
if err != nil {
|
||||
t.Fatalf("HEAD: %v", err)
|
||||
}
|
||||
defer resp.Body.Close()
|
||||
|
||||
if resp.StatusCode != http.StatusOK {
|
||||
t.Errorf("status = %d, want 200 (HEAD)", resp.StatusCode)
|
||||
}
|
||||
if got := resp.Header.Get("Replay-Nonce"); got != "test-nonce-12345" {
|
||||
t.Errorf("Replay-Nonce = %q", got)
|
||||
}
|
||||
if got := resp.Header.Get("Cache-Control"); got != "no-store" {
|
||||
t.Errorf("Cache-Control = %q, want no-store", got)
|
||||
}
|
||||
if resp.ContentLength > 0 {
|
||||
t.Errorf("HEAD body should be zero-length; got Content-Length=%d", resp.ContentLength)
|
||||
}
|
||||
}
|
||||
|
||||
func TestACMEHandler_NewNonce_GET(t *testing.T) {
|
||||
mock := &mockACMEService{}
|
||||
srv := newACMETestServer(t, mock)
|
||||
defer srv.Close()
|
||||
|
||||
resp, err := http.Get(srv.URL + "/acme/profile/prof-corp/new-nonce")
|
||||
if err != nil {
|
||||
t.Fatalf("Get: %v", err)
|
||||
}
|
||||
defer resp.Body.Close()
|
||||
|
||||
if resp.StatusCode != http.StatusNoContent {
|
||||
t.Errorf("status = %d, want 204 (GET)", resp.StatusCode)
|
||||
}
|
||||
if got := resp.Header.Get("Replay-Nonce"); got != "test-nonce-12345" {
|
||||
t.Errorf("Replay-Nonce = %q", got)
|
||||
}
|
||||
if got := resp.Header.Get("Cache-Control"); got != "no-store" {
|
||||
t.Errorf("Cache-Control = %q", got)
|
||||
}
|
||||
}
|
||||
|
||||
func TestACMEHandler_Shorthand_DefaultProfileSet(t *testing.T) {
|
||||
// Service-layer mock returns a directory; handler test asserts the
|
||||
// /acme/directory shorthand reaches the same handler path as the
|
||||
// per-profile directory.
|
||||
mock := &mockACMEService{}
|
||||
srv := newACMETestServer(t, mock)
|
||||
defer srv.Close()
|
||||
|
||||
resp, err := http.Get(srv.URL + "/acme/directory")
|
||||
if err != nil {
|
||||
t.Fatalf("Get: %v", err)
|
||||
}
|
||||
defer resp.Body.Close()
|
||||
|
||||
if resp.StatusCode != http.StatusOK {
|
||||
t.Errorf("status = %d, want 200", resp.StatusCode)
|
||||
}
|
||||
var dir acme.Directory
|
||||
if err := json.NewDecoder(resp.Body).Decode(&dir); err != nil {
|
||||
t.Fatalf("Decode: %v", err)
|
||||
}
|
||||
if !strings.HasSuffix(dir.NewNonce, "/acme/new-nonce") {
|
||||
t.Errorf("NewNonce = %q (shorthand path expected)", dir.NewNonce)
|
||||
}
|
||||
}
|
||||
|
||||
func TestACMEHandler_Shorthand_DefaultProfileUnset(t *testing.T) {
|
||||
mock := &mockACMEService{
|
||||
BuildDirectoryFn: func(ctx context.Context, profileID, baseURL string) (*acme.Directory, error) {
|
||||
return nil, service.ErrACMEUserActionRequired
|
||||
},
|
||||
}
|
||||
srv := newACMETestServer(t, mock)
|
||||
defer srv.Close()
|
||||
|
||||
resp, err := http.Get(srv.URL + "/acme/directory")
|
||||
if err != nil {
|
||||
t.Fatalf("Get: %v", err)
|
||||
}
|
||||
defer resp.Body.Close()
|
||||
|
||||
if resp.StatusCode != http.StatusForbidden {
|
||||
t.Errorf("status = %d, want 403", resp.StatusCode)
|
||||
}
|
||||
if got := resp.Header.Get("Content-Type"); got != acme.ProblemContentType {
|
||||
t.Errorf("content-type = %q, want %q", got, acme.ProblemContentType)
|
||||
}
|
||||
var p acme.Problem
|
||||
if err := json.NewDecoder(resp.Body).Decode(&p); err != nil {
|
||||
t.Fatalf("Decode: %v", err)
|
||||
}
|
||||
if p.Type != "urn:ietf:params:acme:error:userActionRequired" {
|
||||
t.Errorf("Problem.Type = %q", p.Type)
|
||||
}
|
||||
}
|
||||
|
||||
func TestACMEHandler_NewNonce_ServiceError(t *testing.T) {
|
||||
mock := &mockACMEService{
|
||||
IssueNonceFn: func(ctx context.Context) (string, error) {
|
||||
return "", errors.New("disk full")
|
||||
},
|
||||
}
|
||||
srv := newACMETestServer(t, mock)
|
||||
defer srv.Close()
|
||||
|
||||
resp, err := http.Get(srv.URL + "/acme/profile/prof-corp/new-nonce")
|
||||
if err != nil {
|
||||
t.Fatalf("Get: %v", err)
|
||||
}
|
||||
defer resp.Body.Close()
|
||||
|
||||
if resp.StatusCode != http.StatusInternalServerError {
|
||||
t.Errorf("status = %d, want 500", resp.StatusCode)
|
||||
}
|
||||
if got := resp.Header.Get("Content-Type"); got != acme.ProblemContentType {
|
||||
t.Errorf("content-type = %q", got)
|
||||
}
|
||||
}
|
||||
@@ -50,6 +50,23 @@ var SpecParityExceptions = map[string]string{
|
||||
// operator-facing description.
|
||||
"GET /scep-mtls": "Phase 6.5 mTLS sibling route — same wire format as /scep with cert-required gate; documented in docs/legacy-est-scep.md",
|
||||
"POST /scep-mtls": "Phase 6.5 mTLS sibling route — same wire format as /scep with cert-required gate; documented in docs/legacy-est-scep.md",
|
||||
|
||||
// ACME server (RFC 8555 + RFC 9773 ARI) — Phase 1a foundation.
|
||||
// Like SCEP/EST, ACME is a wire-protocol surface (JWS-signed JSON
|
||||
// over HTTPS per RFC 7515) whose semantics are dictated by the RFC
|
||||
// rather than by an OpenAPI document. Documenting every endpoint
|
||||
// in openapi.yaml would duplicate RFC 8555 §7.1 + §7.2 with no
|
||||
// information gain. The canonical reference is docs/acme-server.md.
|
||||
// Subsequent phases will extend this list with new-account,
|
||||
// new-order, finalize, authz, challenge, cert, key-change,
|
||||
// revoke-cert, renewal-info — each gets its own exception entry
|
||||
// in the same commit that lands the route.
|
||||
"GET /acme/profile/{id}/directory": "RFC 8555 §7.1.1 directory; documented in docs/acme-server.md",
|
||||
"HEAD /acme/profile/{id}/new-nonce": "RFC 8555 §7.2 new-nonce; documented in docs/acme-server.md",
|
||||
"GET /acme/profile/{id}/new-nonce": "RFC 8555 §7.2 new-nonce (GET form); documented in docs/acme-server.md",
|
||||
"GET /acme/directory": "RFC 8555 §7.1.1 directory (default-profile shorthand); documented in docs/acme-server.md",
|
||||
"HEAD /acme/new-nonce": "RFC 8555 §7.2 new-nonce (default-profile shorthand); documented in docs/acme-server.md",
|
||||
"GET /acme/new-nonce": "RFC 8555 §7.2 new-nonce GET (default-profile shorthand); documented in docs/acme-server.md",
|
||||
}
|
||||
|
||||
func TestRouter_OpenAPIParity(t *testing.T) {
|
||||
|
||||
@@ -143,6 +143,19 @@ type HandlerRegistry struct {
|
||||
// Both endpoints are admin-gated (M-008 pin updated to include
|
||||
// admin_est.go).
|
||||
AdminEST handler.AdminESTHandler
|
||||
// ACME handles RFC 8555 ACME server endpoints under
|
||||
// /acme/profile/<id>/* and the optional /acme/* shorthand.
|
||||
// Phase 1a wires:
|
||||
// GET /acme/profile/{id}/directory
|
||||
// HEAD /acme/profile/{id}/new-nonce
|
||||
// GET /acme/profile/{id}/new-nonce
|
||||
// GET /acme/directory (shorthand)
|
||||
// HEAD /acme/new-nonce (shorthand)
|
||||
// GET /acme/new-nonce (shorthand)
|
||||
// Subsequent phases add new-account + account/<id>, orders,
|
||||
// authzs, challenges, key-change, revoke-cert, ARI. See
|
||||
// docs/acme-server.md for the configuration reference.
|
||||
ACME handler.ACMEHandler
|
||||
}
|
||||
|
||||
// RegisterHandlers sets up all API routes with their handlers.
|
||||
@@ -389,6 +402,26 @@ func (r *Router) RegisterHandlers(reg HandlerRegistry) {
|
||||
r.Register("DELETE /api/v1/health-checks/{id}", http.HandlerFunc(reg.HealthChecks.DeleteHealthCheck))
|
||||
r.Register("GET /api/v1/health-checks/{id}/history", http.HandlerFunc(reg.HealthChecks.GetHealthCheckHistory))
|
||||
r.Register("POST /api/v1/health-checks/{id}/acknowledge", http.HandlerFunc(reg.HealthChecks.AcknowledgeHealthCheck))
|
||||
|
||||
// ACME (RFC 8555 + RFC 9773 ARI) server endpoints. Phase 1a wires
|
||||
// directory + new-nonce only; Phases 1b-4 extend with the JWS-
|
||||
// authenticated POST surface (new-account, new-order, finalize,
|
||||
// challenges, revoke, ARI). Routes go through r.Register so the
|
||||
// standard middleware chain (CORS, body-limit, audit) applies —
|
||||
// ACME's own per-op metrics + RFC 8555 §6.5 Replay-Nonce headers
|
||||
// are added by the handler.
|
||||
//
|
||||
// Per-profile path family (canonical):
|
||||
r.Register("GET /acme/profile/{id}/directory", http.HandlerFunc(reg.ACME.Directory))
|
||||
r.Register("HEAD /acme/profile/{id}/new-nonce", http.HandlerFunc(reg.ACME.NewNonce))
|
||||
r.Register("GET /acme/profile/{id}/new-nonce", http.HandlerFunc(reg.ACME.NewNonce))
|
||||
// Default-profile shorthand. The handler's profile-resolution path
|
||||
// returns userActionRequired (RFC 7807 + RFC 8555 §6.7) when
|
||||
// CERTCTL_ACME_SERVER_DEFAULT_PROFILE_ID is unset; when set it
|
||||
// dispatches to the same handler as the per-profile path.
|
||||
r.Register("GET /acme/directory", http.HandlerFunc(reg.ACME.Directory))
|
||||
r.Register("HEAD /acme/new-nonce", http.HandlerFunc(reg.ACME.NewNonce))
|
||||
r.Register("GET /acme/new-nonce", http.HandlerFunc(reg.ACME.NewNonce))
|
||||
}
|
||||
|
||||
// RegisterESTHandlers sets up EST (RFC 7030) routes under
|
||||
|
||||
+147
-15
@@ -13,21 +13,27 @@ import (
|
||||
// Config represents the complete application configuration.
|
||||
// All configuration values are read from environment variables with CERTCTL_ prefix.
|
||||
type Config struct {
|
||||
Server ServerConfig
|
||||
Database DatabaseConfig
|
||||
Scheduler SchedulerConfig
|
||||
Log LogConfig
|
||||
Auth AuthConfig
|
||||
RateLimit RateLimitConfig
|
||||
CORS CORSConfig
|
||||
Keygen KeygenConfig
|
||||
CA CAConfig
|
||||
Notifiers NotifierConfig
|
||||
NetworkScan NetworkScanConfig
|
||||
EST ESTConfig
|
||||
SCEP SCEPConfig
|
||||
Verification VerificationConfig
|
||||
ACME ACMEConfig
|
||||
Server ServerConfig
|
||||
Database DatabaseConfig
|
||||
Scheduler SchedulerConfig
|
||||
Log LogConfig
|
||||
Auth AuthConfig
|
||||
RateLimit RateLimitConfig
|
||||
CORS CORSConfig
|
||||
Keygen KeygenConfig
|
||||
CA CAConfig
|
||||
Notifiers NotifierConfig
|
||||
NetworkScan NetworkScanConfig
|
||||
EST ESTConfig
|
||||
SCEP SCEPConfig
|
||||
Verification VerificationConfig
|
||||
ACME ACMEConfig
|
||||
// ACMEServer is the SERVER-side ACME (RFC 8555 + RFC 9773 ARI)
|
||||
// configuration. Distinct from ACME above (which is the consumer-
|
||||
// side issuer connector that talks UP to Let's Encrypt / pebble).
|
||||
// Server uses CERTCTL_ACME_SERVER_* prefix throughout so the two
|
||||
// namespaces stay unambiguous in operator docs and shell env.
|
||||
ACMEServer ACMEServerConfig
|
||||
Vault VaultConfig
|
||||
DigiCert DigiCertConfig
|
||||
Sectigo SectigoConfig
|
||||
@@ -645,6 +651,108 @@ type ACMEConfig struct {
|
||||
Insecure bool
|
||||
}
|
||||
|
||||
// ACMEServerConfig is the SERVER-side ACME (RFC 8555 + RFC 9773 ARI)
|
||||
// configuration. Distinct from ACMEConfig (the consumer-side issuer
|
||||
// connector that talks UP to Let's Encrypt / pebble). Server uses
|
||||
// CERTCTL_ACME_SERVER_* prefix throughout to avoid colliding with
|
||||
// the existing CERTCTL_ACME_* consumer namespace (DIRECTORY_URL /
|
||||
// PROFILE / CHALLENGE_TYPE / etc.).
|
||||
//
|
||||
// Phase 1a wires Enabled / DefaultAuthMode / DefaultProfileID /
|
||||
// NonceTTL / DirectoryMeta. Order/Authz TTLs + the per-challenge-type
|
||||
// concurrency caps + DNS01 resolver are reserved fields populated for
|
||||
// Phases 2/3 — exposing them now keeps the env-var surface stable
|
||||
// from day one (operators can set CERTCTL_ACME_SERVER_HTTP01_CONCURRENCY
|
||||
// today; it's a no-op until Phase 3 reads it).
|
||||
type ACMEServerConfig struct {
|
||||
// Enabled is the master toggle. When false, the ACME handler is
|
||||
// constructed (so the registry-shape stays stable) but no routes
|
||||
// are registered. Operators flip this on after configuring the
|
||||
// per-profile auth_mode column on certificate_profiles.
|
||||
// Setting: CERTCTL_ACME_SERVER_ENABLED.
|
||||
Enabled bool
|
||||
|
||||
// DefaultAuthMode sets the default value of certificate_profiles.acme_auth_mode
|
||||
// for NEWLY-created profiles (e.g. via API). Existing profile rows
|
||||
// retain whatever value they were created with — per-profile
|
||||
// values, once set, override this default. Architecture decision:
|
||||
// auth mode is per-profile, not server-wide.
|
||||
// Valid: "trust_authenticated" (default) or "challenge".
|
||||
// Setting: CERTCTL_ACME_SERVER_DEFAULT_AUTH_MODE.
|
||||
DefaultAuthMode string
|
||||
|
||||
// DefaultProfileID, when set, activates the /acme/* shorthand
|
||||
// path family — /acme/directory mirrors
|
||||
// /acme/profile/<DefaultProfileID>/directory etc. When empty,
|
||||
// requests to the shorthand return RFC 7807
|
||||
// userActionRequired with a hint pointing at the per-profile
|
||||
// path. Single-profile deployments can set this for ergonomic
|
||||
// client config; multi-profile deployments leave it empty.
|
||||
// Setting: CERTCTL_ACME_SERVER_DEFAULT_PROFILE_ID.
|
||||
DefaultProfileID string
|
||||
|
||||
// NonceTTL is how long an issued ACME nonce remains valid before
|
||||
// the server rejects it as expired. RFC 8555 §6.5.1 allows the
|
||||
// server to set any TTL; 5 minutes is the operator-friendly
|
||||
// default (clock-skew tolerant without enabling long-replay
|
||||
// attacks). Setting: CERTCTL_ACME_SERVER_NONCE_TTL.
|
||||
NonceTTL time.Duration
|
||||
|
||||
// OrderTTL is the lifetime of an unfulfilled ACME order. Phase 2
|
||||
// reads; Phase 1a reserves the field. Default: 24h.
|
||||
// Setting: CERTCTL_ACME_SERVER_ORDER_TTL.
|
||||
OrderTTL time.Duration
|
||||
|
||||
// AuthzTTL is the lifetime of an unfulfilled authorization. Phase 2
|
||||
// reads; Phase 1a reserves. Default: 24h.
|
||||
// Setting: CERTCTL_ACME_SERVER_AUTHZ_TTL.
|
||||
AuthzTTL time.Duration
|
||||
|
||||
// HTTP01ConcurrencyMax is the bound on concurrent HTTP-01 validators
|
||||
// (semaphore weight). Phase 3 reads; Phase 1a reserves. Default: 10.
|
||||
// Setting: CERTCTL_ACME_SERVER_HTTP01_CONCURRENCY.
|
||||
HTTP01ConcurrencyMax int
|
||||
|
||||
// DNS01Resolver is the resolver address used by the DNS-01 validator.
|
||||
// Phase 3 reads; Phase 1a reserves. Default: "8.8.8.8:53".
|
||||
// Setting: CERTCTL_ACME_SERVER_DNS01_RESOLVER.
|
||||
DNS01Resolver string
|
||||
|
||||
// DNS01ConcurrencyMax bounds concurrent DNS-01 validators. Default: 10.
|
||||
// Setting: CERTCTL_ACME_SERVER_DNS01_CONCURRENCY.
|
||||
DNS01ConcurrencyMax int
|
||||
|
||||
// TLSALPN01ConcurrencyMax bounds concurrent TLS-ALPN-01 validators.
|
||||
// Default: 10. Setting: CERTCTL_ACME_SERVER_TLSALPN01_CONCURRENCY.
|
||||
TLSALPN01ConcurrencyMax int
|
||||
|
||||
// DirectoryMeta is the optional metadata advertised in the directory
|
||||
// document per RFC 8555 §7.1.1.
|
||||
DirectoryMeta ACMEServerDirectoryMeta
|
||||
}
|
||||
|
||||
// ACMEServerDirectoryMeta holds the optional fields of the directory
|
||||
// `meta` block. Each is populated from a CERTCTL_ACME_SERVER_*
|
||||
// env var; an all-empty struct produces an omitempty-suppressed JSON
|
||||
// `meta` field on the directory.
|
||||
type ACMEServerDirectoryMeta struct {
|
||||
// TermsOfService is a URL pointing to the operator's ToS document.
|
||||
// Setting: CERTCTL_ACME_SERVER_TOS_URL.
|
||||
TermsOfService string
|
||||
// Website is a URL pointing to the operator's homepage.
|
||||
// Setting: CERTCTL_ACME_SERVER_WEBSITE.
|
||||
Website string
|
||||
// CAAIdentities is the list of CAA-record domain values clients
|
||||
// should authorize for this server. Setting:
|
||||
// CERTCTL_ACME_SERVER_CAA_IDENTITIES (comma-separated).
|
||||
CAAIdentities []string
|
||||
// ExternalAccountRequired, when true, signals to clients that
|
||||
// new-account requires an EAB token (RFC 8555 §7.3.4). Phase 1a
|
||||
// advertises but does not enforce; EAB enforcement is a follow-up.
|
||||
// Setting: CERTCTL_ACME_SERVER_EAB_REQUIRED.
|
||||
ExternalAccountRequired bool
|
||||
}
|
||||
|
||||
// OpenSSLConfig contains OpenSSL/Custom CA issuer connector configuration.
|
||||
type OpenSSLConfig struct {
|
||||
// SignScript is the path to a shell script that signs certificate requests.
|
||||
@@ -1646,6 +1754,30 @@ func Load() (*Config, error) {
|
||||
ARIEnabled: getEnvBool("CERTCTL_ACME_ARI_ENABLED", false),
|
||||
Insecure: getEnvBool("CERTCTL_ACME_INSECURE", false),
|
||||
},
|
||||
// ACME server (RFC 8555 + RFC 9773 ARI) — distinct from the
|
||||
// consumer-side ACME issuer connector above. Server uses
|
||||
// CERTCTL_ACME_SERVER_* prefix throughout (audit fix #11).
|
||||
// Phase 1a wires Enabled / DefaultAuthMode / DefaultProfileID /
|
||||
// NonceTTL + DirectoryMeta. Order/Authz TTLs + concurrency
|
||||
// caps + DNS01 resolver are reserved (Phases 2/3 read).
|
||||
ACMEServer: ACMEServerConfig{
|
||||
Enabled: getEnvBool("CERTCTL_ACME_SERVER_ENABLED", false),
|
||||
DefaultAuthMode: getEnv("CERTCTL_ACME_SERVER_DEFAULT_AUTH_MODE", "trust_authenticated"),
|
||||
DefaultProfileID: getEnv("CERTCTL_ACME_SERVER_DEFAULT_PROFILE_ID", ""),
|
||||
NonceTTL: getEnvDuration("CERTCTL_ACME_SERVER_NONCE_TTL", 5*time.Minute),
|
||||
OrderTTL: getEnvDuration("CERTCTL_ACME_SERVER_ORDER_TTL", 24*time.Hour),
|
||||
AuthzTTL: getEnvDuration("CERTCTL_ACME_SERVER_AUTHZ_TTL", 24*time.Hour),
|
||||
HTTP01ConcurrencyMax: getEnvInt("CERTCTL_ACME_SERVER_HTTP01_CONCURRENCY", 10),
|
||||
DNS01Resolver: getEnv("CERTCTL_ACME_SERVER_DNS01_RESOLVER", "8.8.8.8:53"),
|
||||
DNS01ConcurrencyMax: getEnvInt("CERTCTL_ACME_SERVER_DNS01_CONCURRENCY", 10),
|
||||
TLSALPN01ConcurrencyMax: getEnvInt("CERTCTL_ACME_SERVER_TLSALPN01_CONCURRENCY", 10),
|
||||
DirectoryMeta: ACMEServerDirectoryMeta{
|
||||
TermsOfService: getEnv("CERTCTL_ACME_SERVER_TOS_URL", ""),
|
||||
Website: getEnv("CERTCTL_ACME_SERVER_WEBSITE", ""),
|
||||
CAAIdentities: getEnvList("CERTCTL_ACME_SERVER_CAA_IDENTITIES", nil),
|
||||
ExternalAccountRequired: getEnvBool("CERTCTL_ACME_SERVER_EAB_REQUIRED", false),
|
||||
},
|
||||
},
|
||||
Digest: DigestConfig{
|
||||
Enabled: getEnvBool("CERTCTL_DIGEST_ENABLED", false),
|
||||
Interval: getEnvDuration("CERTCTL_DIGEST_INTERVAL", 24*time.Hour),
|
||||
|
||||
@@ -0,0 +1,86 @@
|
||||
// Copyright (c) certctl
|
||||
// SPDX-License-Identifier: BSL-1.1
|
||||
|
||||
package postgres
|
||||
|
||||
import (
|
||||
"context"
|
||||
"database/sql"
|
||||
"fmt"
|
||||
"time"
|
||||
)
|
||||
|
||||
// ACMERepository implements the ACME server's persistence layer
|
||||
// (RFC 8555 + RFC 9773 ARI). Phase 1a wires only nonce operations
|
||||
// (IssueNonce + ConsumeNonce); Phase 1b extends with account CRUD,
|
||||
// Phase 2 with order/authz/challenge CRUD, Phase 4 with the
|
||||
// key-rollover atomic update path.
|
||||
type ACMERepository struct {
|
||||
db *sql.DB
|
||||
}
|
||||
|
||||
// NewACMERepository constructs an ACMERepository wrapping the supplied
|
||||
// *sql.DB. The constructor is symmetric with NewAuditRepository,
|
||||
// NewProfileRepository, etc. — main.go owns the lifecycle.
|
||||
func NewACMERepository(db *sql.DB) *ACMERepository {
|
||||
return &ACMERepository{db: db}
|
||||
}
|
||||
|
||||
// IssueNonce inserts a new ACME nonce row with the given TTL. The
|
||||
// caller (typically ACMEService.IssueNonce) is responsible for
|
||||
// generating the nonce string itself via acme.GenerateNonce; this
|
||||
// method is the persistence write.
|
||||
//
|
||||
// RFC 8555 §6.5: nonces issued by the server can be redeemed exactly
|
||||
// once. The PRIMARY KEY guarantees insertion uniqueness; ConsumeNonce
|
||||
// flips the `used` column atomically so a replay sees `used=true`.
|
||||
func (r *ACMERepository) IssueNonce(ctx context.Context, nonce string, ttl time.Duration) error {
|
||||
_, err := r.db.ExecContext(ctx, `
|
||||
INSERT INTO acme_nonces (nonce, issued_at, expires_at, used)
|
||||
VALUES ($1, NOW(), $2, FALSE)
|
||||
`, nonce, time.Now().Add(ttl))
|
||||
if err != nil {
|
||||
return fmt.Errorf("acme: insert nonce: %w", err)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// ConsumeNonce flips the nonce's `used` column to true atomically.
|
||||
// Returns sql.ErrNoRows if:
|
||||
//
|
||||
// - the nonce was never issued (caller's payload was forged or
|
||||
// truncated)
|
||||
// - the nonce was already consumed (replay attempt)
|
||||
// - the nonce has expired (CERTCTL_ACME_SERVER_NONCE_TTL window
|
||||
// elapsed since issuance)
|
||||
//
|
||||
// All three failure modes are mapped by the JWS verifier (Phase 1b)
|
||||
// to urn:ietf:params:acme:error:badNonce per RFC 8555 §6.5.1. Phase
|
||||
// 1a does not yet call ConsumeNonce — the JWS-authenticated POST
|
||||
// path arrives in Phase 1b.
|
||||
//
|
||||
// The single UPDATE statement is the atomic primitive: a concurrent
|
||||
// second consume races for the same row, but only one of them flips
|
||||
// `used` from false → true. Postgres's row-level locking serializes
|
||||
// the writes; the loser's UPDATE matches zero rows (because used is
|
||||
// already true) and returns sql.ErrNoRows.
|
||||
func (r *ACMERepository) ConsumeNonce(ctx context.Context, nonce string) error {
|
||||
res, err := r.db.ExecContext(ctx, `
|
||||
UPDATE acme_nonces
|
||||
SET used = TRUE
|
||||
WHERE nonce = $1
|
||||
AND used = FALSE
|
||||
AND expires_at > NOW()
|
||||
`, nonce)
|
||||
if err != nil {
|
||||
return fmt.Errorf("acme: consume nonce: %w", err)
|
||||
}
|
||||
n, err := res.RowsAffected()
|
||||
if err != nil {
|
||||
return fmt.Errorf("acme: consume nonce rows affected: %w", err)
|
||||
}
|
||||
if n == 0 {
|
||||
return sql.ErrNoRows
|
||||
}
|
||||
return nil
|
||||
}
|
||||
@@ -0,0 +1,209 @@
|
||||
// Copyright (c) certctl
|
||||
// SPDX-License-Identifier: BSL-1.1
|
||||
|
||||
package service
|
||||
|
||||
import (
|
||||
"context"
|
||||
"errors"
|
||||
"fmt"
|
||||
"sync/atomic"
|
||||
"time"
|
||||
|
||||
"github.com/shankar0123/certctl/internal/api/acme"
|
||||
"github.com/shankar0123/certctl/internal/config"
|
||||
"github.com/shankar0123/certctl/internal/domain"
|
||||
"github.com/shankar0123/certctl/internal/repository"
|
||||
)
|
||||
|
||||
// ACMERepo is the persistence-layer surface ACMEService consumes for
|
||||
// nonce + (later phases) account / order / authz / challenge state.
|
||||
// Phase 1a wires only the nonce path; the interface is tightened in
|
||||
// Phase 1b along with the AccountService.
|
||||
//
|
||||
// Defining the interface in the service package (rather than
|
||||
// internal/repository/interfaces.go) keeps the cross-phase blast
|
||||
// radius small: when Phase 1b adds CreateAccountWithTx /
|
||||
// GetAccountByThumbprint / etc., only this file's interface and the
|
||||
// concrete postgres ACMERepository move together. Mock implementations
|
||||
// in tests satisfy this interface without depending on the postgres
|
||||
// package.
|
||||
type ACMERepo interface {
|
||||
IssueNonce(ctx context.Context, nonce string, ttl time.Duration) error
|
||||
ConsumeNonce(ctx context.Context, nonce string) error
|
||||
}
|
||||
|
||||
// profileLookup is the minimum surface ACMEService needs to resolve a
|
||||
// per-profile request. Defined as an interface (rather than taking a
|
||||
// concrete *postgres.ProfileRepository) so tests can inject an in-memory
|
||||
// fake without spinning up Postgres.
|
||||
type profileLookup interface {
|
||||
Get(ctx context.Context, id string) (*domain.CertificateProfile, error)
|
||||
}
|
||||
|
||||
// ACMEService orchestrates the ACME server's RFC 8555 surface. Phase 1a
|
||||
// implements:
|
||||
//
|
||||
// - BuildDirectory: returns the per-profile directory document.
|
||||
// - IssueNonce: returns a Replay-Nonce, persisted with TTL.
|
||||
//
|
||||
// Phase 1b will extend with VerifyJWS, NewAccount, LookupAccount,
|
||||
// UpdateAccount, DeactivateAccount.
|
||||
//
|
||||
// The struct deliberately holds raw config rather than per-field
|
||||
// extracted values — the directory builder uses 4 of the 11 fields
|
||||
// and reading them lazily keeps the constructor signature tight.
|
||||
type ACMEService struct {
|
||||
repo ACMERepo
|
||||
profiles profileLookup
|
||||
cfg config.ACMEServerConfig
|
||||
metrics *ACMEMetrics
|
||||
}
|
||||
|
||||
// NewACMEService constructs an ACMEService. The constructor matches
|
||||
// certctl's per-service convention: required dependencies in the
|
||||
// argument list (repo, profile lookup, config), optional wiring via
|
||||
// post-construction setters (metrics is wired now to keep the
|
||||
// Phase-1a-only footprint clean; Phase 1b adds SetTransactor +
|
||||
// SetAuditService for the JWS-authenticated POST path).
|
||||
func NewACMEService(repo ACMERepo, profiles profileLookup, cfg config.ACMEServerConfig) *ACMEService {
|
||||
return &ACMEService{
|
||||
repo: repo,
|
||||
profiles: profiles,
|
||||
cfg: cfg,
|
||||
metrics: NewACMEMetrics(),
|
||||
}
|
||||
}
|
||||
|
||||
// Metrics returns the per-op counter snapshotter. cmd/server/main.go
|
||||
// passes this into MetricsHandler so the Prometheus exposer picks up
|
||||
// the per-op signals.
|
||||
func (s *ACMEService) Metrics() *ACMEMetrics { return s.metrics }
|
||||
|
||||
// ErrACMEUserActionRequired is returned by BuildDirectory when the
|
||||
// caller hits the /acme/* shorthand path without
|
||||
// CERTCTL_ACME_SERVER_DEFAULT_PROFILE_ID being set. Handler maps to
|
||||
// RFC 7807 + RFC 8555 §6.7 userActionRequired.
|
||||
var ErrACMEUserActionRequired = errors.New("acme: default profile not configured; use /acme/profile/<id>/*")
|
||||
|
||||
// ErrACMEProfileNotFound is returned when the profile in the request
|
||||
// path doesn't exist. Handler maps to HTTP 404 (NOT 500 — the
|
||||
// distinction is operator-meaningful: 404 says "fix your URL," 500
|
||||
// says "something is wrong server-side").
|
||||
var ErrACMEProfileNotFound = errors.New("acme: profile not found")
|
||||
|
||||
// BuildDirectory constructs the per-profile directory document.
|
||||
//
|
||||
// profileID resolution:
|
||||
// - non-empty: look up that profile; ErrACMEProfileNotFound on miss.
|
||||
// - empty + cfg.DefaultProfileID set: substitute the default.
|
||||
// - empty + cfg.DefaultProfileID unset: ErrACMEUserActionRequired.
|
||||
//
|
||||
// baseURL is the per-profile base path the directory's URL fields are
|
||||
// constructed against. The handler computes baseURL from the inbound
|
||||
// request (scheme + host + /acme/profile/<id>) and passes it in;
|
||||
// keeping the URL composition in the handler avoids embedding HTTP
|
||||
// concerns in the service layer.
|
||||
//
|
||||
// On success the metrics counter for the directory op increments;
|
||||
// failures bump the failure variant of the same counter.
|
||||
func (s *ACMEService) BuildDirectory(ctx context.Context, profileID, baseURL string) (*acme.Directory, error) {
|
||||
profileID, err := s.resolveProfile(ctx, profileID)
|
||||
if err != nil {
|
||||
s.metrics.bump(&s.metrics.DirectoryFailureTotal)
|
||||
return nil, err
|
||||
}
|
||||
dir := acme.BuildDirectory(
|
||||
baseURL,
|
||||
s.cfg.DirectoryMeta.TermsOfService,
|
||||
s.cfg.DirectoryMeta.Website,
|
||||
s.cfg.DirectoryMeta.CAAIdentities,
|
||||
s.cfg.DirectoryMeta.ExternalAccountRequired,
|
||||
// Phase 1a: ARI is non-functional. The Phase 4 commit flips this
|
||||
// to true once the renewal-info handler ships.
|
||||
false,
|
||||
)
|
||||
_ = profileID // Phase 1b will use the resolved profile to read
|
||||
// acme_auth_mode + record per-profile metrics. Phase 1a
|
||||
// only needs the existence check above.
|
||||
s.metrics.bump(&s.metrics.DirectoryTotal)
|
||||
return dir, nil
|
||||
}
|
||||
|
||||
// IssueNonce generates a fresh ACME nonce, persists it with the
|
||||
// configured TTL, and returns the encoded string for the
|
||||
// Replay-Nonce header.
|
||||
//
|
||||
// RFC 8555 §6.5: every successful ACME response carries a
|
||||
// Replay-Nonce. Phase 1a wires this via the directory + new-nonce
|
||||
// handlers; Phase 1b extends with new-account + account/<id> POST
|
||||
// responses (the JWS-authenticated paths).
|
||||
func (s *ACMEService) IssueNonce(ctx context.Context) (string, error) {
|
||||
nonce, err := acme.GenerateNonce()
|
||||
if err != nil {
|
||||
s.metrics.bump(&s.metrics.NewNonceFailureTotal)
|
||||
return "", fmt.Errorf("acme: generate nonce: %w", err)
|
||||
}
|
||||
if err := s.repo.IssueNonce(ctx, nonce, s.cfg.NonceTTL); err != nil {
|
||||
s.metrics.bump(&s.metrics.NewNonceFailureTotal)
|
||||
return "", fmt.Errorf("acme: persist nonce: %w", err)
|
||||
}
|
||||
s.metrics.bump(&s.metrics.NewNonceTotal)
|
||||
return nonce, nil
|
||||
}
|
||||
|
||||
// resolveProfile applies the default-profile fallback and confirms the
|
||||
// profile exists. Returns the resolved (canonical) profileID on
|
||||
// success. Centralizing the resolution here keeps every Phase
|
||||
// 1a/1b/2/3/4 endpoint's "which profile is this request bound to"
|
||||
// logic uniform.
|
||||
func (s *ACMEService) resolveProfile(ctx context.Context, profileID string) (string, error) {
|
||||
if profileID == "" {
|
||||
if s.cfg.DefaultProfileID == "" {
|
||||
return "", ErrACMEUserActionRequired
|
||||
}
|
||||
profileID = s.cfg.DefaultProfileID
|
||||
}
|
||||
_, err := s.profiles.Get(ctx, profileID)
|
||||
if err != nil {
|
||||
if errors.Is(err, repository.ErrNotFound) {
|
||||
return "", ErrACMEProfileNotFound
|
||||
}
|
||||
return "", fmt.Errorf("acme: lookup profile: %w", err)
|
||||
}
|
||||
return profileID, nil
|
||||
}
|
||||
|
||||
// ACMEMetrics is the per-op counter table for the ACME server. Mirrors
|
||||
// the IssuanceMetrics / DeployCounters pattern (atomic.Uint64 + a
|
||||
// Snapshot method that emits stable tuples). Phase 1a tracks just
|
||||
// directory + new-nonce; subsequent phases add new-account / new-order
|
||||
// / etc.
|
||||
type ACMEMetrics struct {
|
||||
DirectoryTotal atomic.Uint64
|
||||
DirectoryFailureTotal atomic.Uint64
|
||||
NewNonceTotal atomic.Uint64
|
||||
NewNonceFailureTotal atomic.Uint64
|
||||
}
|
||||
|
||||
// NewACMEMetrics returns a zeroed counter table. Concurrent callers
|
||||
// can bump counters without external synchronization (atomic.Uint64
|
||||
// is the synchronization primitive).
|
||||
func NewACMEMetrics() *ACMEMetrics { return &ACMEMetrics{} }
|
||||
|
||||
// bump increments a single atomic counter. Centralized so the call
|
||||
// sites in BuildDirectory + IssueNonce are uniform.
|
||||
func (m *ACMEMetrics) bump(c *atomic.Uint64) { c.Add(1) }
|
||||
|
||||
// Snapshot emits the current counter values as a map (op → count).
|
||||
// Naming is certctl_acme_<op>_total per frozen decision 0.10
|
||||
// (cardinality discipline) so the Prometheus exposer can lift them
|
||||
// directly without per-op stringly-typed branching.
|
||||
func (m *ACMEMetrics) Snapshot() map[string]uint64 {
|
||||
return map[string]uint64{
|
||||
"certctl_acme_directory_total": m.DirectoryTotal.Load(),
|
||||
"certctl_acme_directory_failures_total": m.DirectoryFailureTotal.Load(),
|
||||
"certctl_acme_new_nonce_total": m.NewNonceTotal.Load(),
|
||||
"certctl_acme_new_nonce_failures_total": m.NewNonceFailureTotal.Load(),
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,181 @@
|
||||
// Copyright (c) certctl
|
||||
// SPDX-License-Identifier: BSL-1.1
|
||||
|
||||
package service
|
||||
|
||||
import (
|
||||
"context"
|
||||
"errors"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"github.com/shankar0123/certctl/internal/config"
|
||||
"github.com/shankar0123/certctl/internal/domain"
|
||||
"github.com/shankar0123/certctl/internal/repository"
|
||||
)
|
||||
|
||||
// fakeACMERepo is an in-memory ACMERepo for tests. It tracks issued
|
||||
// nonces in a map; Consume removes the entry to model one-shot use.
|
||||
type fakeACMERepo struct {
|
||||
issued map[string]time.Time // nonce → expires_at
|
||||
issueErr error
|
||||
}
|
||||
|
||||
func newFakeACMERepo() *fakeACMERepo {
|
||||
return &fakeACMERepo{issued: make(map[string]time.Time)}
|
||||
}
|
||||
|
||||
func (f *fakeACMERepo) IssueNonce(ctx context.Context, nonce string, ttl time.Duration) error {
|
||||
if f.issueErr != nil {
|
||||
return f.issueErr
|
||||
}
|
||||
f.issued[nonce] = time.Now().Add(ttl)
|
||||
return nil
|
||||
}
|
||||
|
||||
func (f *fakeACMERepo) ConsumeNonce(ctx context.Context, nonce string) error {
|
||||
exp, ok := f.issued[nonce]
|
||||
if !ok {
|
||||
return errors.New("not found")
|
||||
}
|
||||
if time.Now().After(exp) {
|
||||
return errors.New("expired")
|
||||
}
|
||||
delete(f.issued, nonce)
|
||||
return nil
|
||||
}
|
||||
|
||||
// fakeProfileLookup is an in-memory profileLookup that returns the
|
||||
// profile by ID. Unknown IDs return repository.ErrNotFound (the
|
||||
// canonical sentinel ACMEService maps to ErrACMEProfileNotFound).
|
||||
type fakeProfileLookup struct {
|
||||
profiles map[string]*domain.CertificateProfile
|
||||
}
|
||||
|
||||
func (f *fakeProfileLookup) Get(ctx context.Context, id string) (*domain.CertificateProfile, error) {
|
||||
p, ok := f.profiles[id]
|
||||
if !ok {
|
||||
return nil, repository.ErrNotFound
|
||||
}
|
||||
return p, nil
|
||||
}
|
||||
|
||||
func newSvc(t *testing.T, cfg config.ACMEServerConfig, profiles map[string]*domain.CertificateProfile) (*ACMEService, *fakeACMERepo) {
|
||||
t.Helper()
|
||||
repo := newFakeACMERepo()
|
||||
pl := &fakeProfileLookup{profiles: profiles}
|
||||
return NewACMEService(repo, pl, cfg), repo
|
||||
}
|
||||
|
||||
func TestBuildDirectory_HappyPath(t *testing.T) {
|
||||
cfg := config.ACMEServerConfig{
|
||||
NonceTTL: 5 * time.Minute,
|
||||
}
|
||||
cfg.DirectoryMeta.TermsOfService = "https://example.com/tos"
|
||||
cfg.DirectoryMeta.Website = "https://example.com"
|
||||
svc, _ := newSvc(t, cfg, map[string]*domain.CertificateProfile{
|
||||
"prof-corp": {ID: "prof-corp", Name: "corp"},
|
||||
})
|
||||
dir, err := svc.BuildDirectory(context.Background(), "prof-corp", "https://server/acme/profile/prof-corp")
|
||||
if err != nil {
|
||||
t.Fatalf("BuildDirectory: %v", err)
|
||||
}
|
||||
if dir == nil {
|
||||
t.Fatal("dir is nil")
|
||||
}
|
||||
if dir.NewNonce != "https://server/acme/profile/prof-corp/new-nonce" {
|
||||
t.Errorf("NewNonce = %q", dir.NewNonce)
|
||||
}
|
||||
if dir.Meta == nil || dir.Meta.TermsOfService != "https://example.com/tos" {
|
||||
t.Errorf("meta tos = %+v", dir.Meta)
|
||||
}
|
||||
if got := svc.Metrics().DirectoryTotal.Load(); got != 1 {
|
||||
t.Errorf("DirectoryTotal = %d, want 1", got)
|
||||
}
|
||||
}
|
||||
|
||||
func TestBuildDirectory_UnknownProfile(t *testing.T) {
|
||||
cfg := config.ACMEServerConfig{NonceTTL: 5 * time.Minute}
|
||||
svc, _ := newSvc(t, cfg, nil)
|
||||
_, err := svc.BuildDirectory(context.Background(), "prof-missing", "https://server/acme/profile/prof-missing")
|
||||
if !errors.Is(err, ErrACMEProfileNotFound) {
|
||||
t.Errorf("err = %v, want ErrACMEProfileNotFound", err)
|
||||
}
|
||||
if got := svc.Metrics().DirectoryFailureTotal.Load(); got != 1 {
|
||||
t.Errorf("DirectoryFailureTotal = %d, want 1", got)
|
||||
}
|
||||
}
|
||||
|
||||
func TestBuildDirectory_EmptyProfileNoDefault(t *testing.T) {
|
||||
cfg := config.ACMEServerConfig{NonceTTL: 5 * time.Minute}
|
||||
svc, _ := newSvc(t, cfg, nil)
|
||||
_, err := svc.BuildDirectory(context.Background(), "", "https://server/acme")
|
||||
if !errors.Is(err, ErrACMEUserActionRequired) {
|
||||
t.Errorf("err = %v, want ErrACMEUserActionRequired", err)
|
||||
}
|
||||
}
|
||||
|
||||
func TestBuildDirectory_EmptyProfileWithDefault(t *testing.T) {
|
||||
cfg := config.ACMEServerConfig{
|
||||
NonceTTL: 5 * time.Minute,
|
||||
DefaultProfileID: "prof-default",
|
||||
}
|
||||
svc, _ := newSvc(t, cfg, map[string]*domain.CertificateProfile{
|
||||
"prof-default": {ID: "prof-default", Name: "default"},
|
||||
})
|
||||
dir, err := svc.BuildDirectory(context.Background(), "", "https://server/acme")
|
||||
if err != nil {
|
||||
t.Fatalf("BuildDirectory: %v", err)
|
||||
}
|
||||
if dir.NewNonce != "https://server/acme/new-nonce" {
|
||||
t.Errorf("NewNonce = %q (shorthand path)", dir.NewNonce)
|
||||
}
|
||||
}
|
||||
|
||||
func TestIssueNonce_HappyPath(t *testing.T) {
|
||||
cfg := config.ACMEServerConfig{NonceTTL: 5 * time.Minute}
|
||||
svc, repo := newSvc(t, cfg, nil)
|
||||
n, err := svc.IssueNonce(context.Background())
|
||||
if err != nil {
|
||||
t.Fatalf("IssueNonce: %v", err)
|
||||
}
|
||||
if len(n) != 43 {
|
||||
t.Errorf("nonce length = %d, want 43 (base64url-no-pad of 32 bytes)", len(n))
|
||||
}
|
||||
if _, ok := repo.issued[n]; !ok {
|
||||
t.Errorf("issued nonce was not persisted")
|
||||
}
|
||||
if got := svc.Metrics().NewNonceTotal.Load(); got != 1 {
|
||||
t.Errorf("NewNonceTotal = %d, want 1", got)
|
||||
}
|
||||
}
|
||||
|
||||
func TestIssueNonce_RepoFailure(t *testing.T) {
|
||||
cfg := config.ACMEServerConfig{NonceTTL: 5 * time.Minute}
|
||||
svc, repo := newSvc(t, cfg, nil)
|
||||
repo.issueErr = errors.New("disk full")
|
||||
_, err := svc.IssueNonce(context.Background())
|
||||
if err == nil {
|
||||
t.Fatal("expected error from IssueNonce when repo fails")
|
||||
}
|
||||
if got := svc.Metrics().NewNonceFailureTotal.Load(); got != 1 {
|
||||
t.Errorf("NewNonceFailureTotal = %d, want 1", got)
|
||||
}
|
||||
}
|
||||
|
||||
func TestACMEMetrics_Snapshot(t *testing.T) {
|
||||
m := NewACMEMetrics()
|
||||
m.DirectoryTotal.Store(7)
|
||||
m.NewNonceTotal.Store(11)
|
||||
m.NewNonceFailureTotal.Store(2)
|
||||
snap := m.Snapshot()
|
||||
if snap["certctl_acme_directory_total"] != 7 {
|
||||
t.Errorf("directory_total = %d", snap["certctl_acme_directory_total"])
|
||||
}
|
||||
if snap["certctl_acme_new_nonce_total"] != 11 {
|
||||
t.Errorf("new_nonce_total = %d", snap["certctl_acme_new_nonce_total"])
|
||||
}
|
||||
if snap["certctl_acme_new_nonce_failures_total"] != 2 {
|
||||
t.Errorf("new_nonce_failures_total = %d", snap["certctl_acme_new_nonce_failures_total"])
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user