 shankar0123
|
c351bba41a
|
acme-server: orders + authorizations + finalize + cert download (Phase 2/7)
Closes the issuance loop in trust_authenticated mode (commits ec88a61
+ 44a85d6 wired the foundation + JWS-verified account resource).
After this commit, an ACME client running against a profile with
acme_auth_mode='trust_authenticated' end-to-end-issues a real cert:
POST /acme/profile/<id>/new-order → 201 + order URL (status=ready)
POST /acme/profile/<id>/order/<oid> → POST-as-GET fetch
POST /acme/profile/<id>/order/<oid>/finalize → 200 + status=valid + cert URL
POST /acme/profile/<id>/cert/<cid> → 200 + PEM chain
Profiles with acme_auth_mode='challenge' get the same code path with
authz/challenge rows in `pending` state until Phase 3's validators
wire up. The mode is read from the bound profile's column at request
time, NOT cached at server start — operators flipping the column via
SQL take effect on the next order without restart.
Architecture (the load-bearing part):
- Finalize routes through service.CertificateService.Create — the
canonical certctl issuance entry point that wraps the
managed_certificates row insert + audit row in s.tx.WithinTx.
RenewalPolicy / CertificateProfile / per-issuer-type Prometheus
metrics / audit rows all apply uniformly to ACME-issued certs via
the same code path that already serves EST/SCEP/agent/REST issuance.
- Identifier validation runs BEFORE order creation. Rejected
identifiers return RFC 7807 with per-identifier subproblems and
create no order row.
- Source stamp on managed_certificates: domain.CertificateSourceACME.
Operators bulk-revoke ACME-issued certs by filtering on Source=ACME.
- 3-step atomicity boundary documented in code + this commit msg:
(A) WithinTx-A marks order processing + audit row.
(B) IssuerConnector.IssueCertificate + CertificateService.Create
(each in its own WithinTx — Create wraps cert row + audit
atomically).
(C) WithinTx-C creates certificate_versions row + transitions order
to valid + sets certificate_id + audit row.
The brief window between B and C can leave a managed_certificates
row whose order is still in `processing`. Phase 5's GC scheduler
reconciles. Documented inline.
What ships:
- internal/api/acme/order.go: OrderResponseJSON + AuthorizationResponseJSON
+ ChallengeResponseJSON + NewOrderRequest + FinalizeRequest wire
shapes; ValidateIdentifiers (Phase 2 syntactic checks, dns-only);
CSRMatchesIdentifiers (RFC 8555 §7.4 strict equality, case-folded).
- internal/domain/acme.go: ACMEOrder + ACMEAuthorization + ACMEChallenge
+ ACMEIdentifier + ACMEProblem domain types + closed status enums
for each (order: pending|ready|processing|valid|invalid; authz:
pending|valid|invalid|deactivated|expired|revoked; challenge:
pending|processing|valid|invalid; challenge type: http-01|dns-01|
tls-alpn-01).
- internal/domain/profile.go: new ACMEAuthMode field reading from
certificate_profiles.acme_auth_mode (added in migration 25).
- internal/domain/certificate.go: new CertificateSourceACME enum value.
- internal/repository/postgres/profile.go: extended SELECT/scanProfile
to read the per-profile acme_auth_mode column with a COALESCE
default of trust_authenticated.
- internal/repository/postgres/acme.go: full order/authz/challenge
CRUD (CreateOrderWithTx + GetOrderByID + UpdateOrderWithTx +
CreateAuthzWithTx + GetAuthzByID + ListAuthzsByOrder +
ListChallengesByAuthz + CreateChallengeWithTx) with proper
sql.NullTime + JSONB handling. scanACMEOrder /
scanACMEAuthz / scanACMEChallenge helpers.
- internal/service/acme.go: extended ACMERepo interface; new
SetIssuancePipeline wires certificateService + certificateRepo +
issuerRegistry. CreateOrder (auth-mode-dispatched: trust_authenticated
auto-marks order ready + authz valid + 1 placeholder http-01
challenge valid; challenge mode keeps everything pending). LookupOrder
(with account-ownership assertion). LookupAuthz. ListAuthzsByOrder.
FinalizeOrder (3-step atomicity boundary as above; CSR-vs-order
SAN strict-equality check before issuance; persists FinalizeOrderResult
{Order, CertID}). LookupCertificate. randIDSuffix + base32encode
helpers for the human-readable acme-ord-* / acme-authz-* /
acme-chall-* prefixes (CLAUDE.md "TEXT primary keys with human-
readable prefixes" architecture decision). 8 new per-op metrics.
- internal/service/acme_test.go: extended fakeACMERepo with Phase 2
interface stubs; new orderTrackingRepo for observable persistence;
2 new tests asserting trust_authenticated → auto-ready/valid and
challenge → stays-pending.
- internal/api/handler/acme.go: NewOrder + Order + OrderFinalize +
Authz + Cert handler methods. orderURL / authzURL / certURL /
challengeURLBuilder helpers; marshalOrderForResponse fetches
per-order authzs to populate the URL list. parseOptionalTime for
notBefore / notAfter.
- internal/api/handler/acme_handler_test.go: extended mockACMEService
with Phase 2 method stubs; 4 new handler tests (NewOrder happy +
rejected-identifier + OrderFinalize bad-CSR + Cert happy).
- internal/api/router/router.go: 10 new Register calls (5 per-profile
+ 5 shorthand) for new-order, order/{ord_id}, order/{ord_id}/finalize,
authz/{authz_id}, cert/{cert_id}.
- internal/api/router/openapi_parity_test.go + api/openapi-handler-exceptions.yaml:
10 new exception entries.
- cmd/server/main.go: SetIssuancePipeline at startup, threading
certificateService + certificateRepo + issuerRegistry into ACMEService.
- docs/acme-server.md: phase status updated; endpoints table grows
5 rows for new-order/order/finalize/authz/cert (per-profile +
shorthand variants); new section "Finalize routing through
CertificateService.Create" documenting the 3-step atomicity
boundary + the actor-string convention `acme:<account-id>`.
Tests: ACME package + service + handler + router + config + domain
all green under -short. New cases:
- TestCreateOrder_TrustAuthenticated_AutoReady (asserts auto-ready
transition + valid-status authz/challenge + audit row + metric bump).
- TestCreateOrder_ChallengeMode_StaysPending (asserts pending-status
cascading authz/challenge for challenge mode).
- TestACMEHandler_NewOrder_HappyPath (asserts 201 + Location +
finalize URL shape).
- TestACMEHandler_NewOrder_RejectedIdentifier (asserts 400 + RFC 7807
rejectedIdentifier + per-identifier subproblems for type=ip).
- TestACMEHandler_OrderFinalize_BadCSR (asserts 400 + badCSR for
non-base64 CSR field).
- TestACMEHandler_Cert_HappyPath (asserts 200 + PEM content-type +
PEM chain in body).
Engineering history: cowork/WORKSPACE-CHANGELOG.md "ACME-Server-2".
|
2026-05-03 13:46:10 +00:00 |
|