-
Notifications
You must be signed in to change notification settings - Fork 4.3k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge branch 'main' into vault-27421-update-cap-ldap-dep
- Loading branch information
Showing
13 changed files
with
589 additions
and
39 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,226 @@ | ||
| // Copyright (c) HashiCorp, Inc. | ||
| // SPDX-License-Identifier: BUSL-1.1 | ||
|
|
||
| package pki | ||
|
|
||
| import ( | ||
| "context" | ||
| "errors" | ||
| "fmt" | ||
| "strings" | ||
| "time" | ||
|
|
||
| "github.com/hashicorp/vault/sdk/framework" | ||
| "github.com/hashicorp/vault/sdk/logical" | ||
| ) | ||
|
|
||
| func pathAcmeMgmtAccountList(b *backend) *framework.Path { | ||
| return &framework.Path{ | ||
| Pattern: "acme/mgmt/account/keyid/?$", | ||
|
|
||
| Operations: map[logical.Operation]framework.OperationHandler{ | ||
| logical.ListOperation: &framework.PathOperation{ | ||
| Callback: b.pathAcmeMgmtListAccounts, | ||
| DisplayAttrs: &framework.DisplayAttributes{ | ||
| OperationPrefix: operationPrefixPKI, | ||
| OperationVerb: "list-acme-account-keys", | ||
| Description: "List all ACME account key identifiers.", | ||
| }, | ||
| }, | ||
| }, | ||
|
|
||
| HelpSynopsis: "List all ACME account key identifiers.", | ||
| HelpDescription: `Allows an operator to list all ACME account key identifiers.`, | ||
| } | ||
| } | ||
|
|
||
| func pathAcmeMgmtAccountRead(b *backend) *framework.Path { | ||
| return &framework.Path{ | ||
| Pattern: "acme/mgmt/account/keyid/" + framework.GenericNameRegex("keyid"), | ||
| Fields: map[string]*framework.FieldSchema{ | ||
| "keyid": { | ||
| Type: framework.TypeString, | ||
| Description: "The key identifier of the account.", | ||
| Required: true, | ||
| }, | ||
| "status": { | ||
| Type: framework.TypeString, | ||
| Description: "The status of the account.", | ||
| Required: true, | ||
| AllowedValues: []interface{}{AccountStatusValid.String(), AccountStatusRevoked.String()}, | ||
| }, | ||
| }, | ||
| Operations: map[logical.Operation]framework.OperationHandler{ | ||
| logical.ReadOperation: &framework.PathOperation{ | ||
| Callback: b.pathAcmeMgmtReadAccount, | ||
| DisplayAttrs: &framework.DisplayAttributes{ | ||
| OperationPrefix: operationPrefixPKI, | ||
| OperationSuffix: "acme-key-id", | ||
| }, | ||
| }, | ||
| logical.UpdateOperation: &framework.PathOperation{ | ||
| Callback: b.pathAcmeMgmtUpdateAccount, | ||
| DisplayAttrs: &framework.DisplayAttributes{ | ||
| OperationPrefix: operationPrefixPKI, | ||
| OperationSuffix: "acme-key-id", | ||
| }, | ||
| }, | ||
| }, | ||
|
|
||
| HelpSynopsis: "Fetch the details or update the status of an ACME account by key identifier.", | ||
| HelpDescription: `Allows an operator to retrieve details of an ACME account and to update the account status.`, | ||
| } | ||
| } | ||
|
|
||
| func (b *backend) pathAcmeMgmtListAccounts(ctx context.Context, r *logical.Request, d *framework.FieldData) (*logical.Response, error) { | ||
| sc := b.makeStorageContext(ctx, r.Storage) | ||
|
|
||
| accountIds, err := b.GetAcmeState().ListAccountIds(sc) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
|
|
||
| return logical.ListResponse(accountIds), nil | ||
| } | ||
|
|
||
| func (b *backend) pathAcmeMgmtReadAccount(ctx context.Context, r *logical.Request, d *framework.FieldData) (*logical.Response, error) { | ||
| keyId := d.Get("keyid").(string) | ||
| if len(keyId) == 0 { | ||
| return logical.ErrorResponse("keyid is required"), logical.ErrInvalidRequest | ||
| } | ||
|
|
||
| sc := b.makeStorageContext(ctx, r.Storage) | ||
| as := b.GetAcmeState() | ||
|
|
||
| accountEntry, err := as.LoadAccountWithoutDirEnforcement(sc, keyId) | ||
| if err != nil { | ||
| if errors.Is(err, ErrAccountDoesNotExist) { | ||
| return logical.ErrorResponse("ACME key id %s did not exist", keyId), logical.ErrNotFound | ||
| } | ||
| return nil, fmt.Errorf("failed loading ACME account id %q: %w", keyId, err) | ||
| } | ||
|
|
||
| orders, err := as.LoadAccountOrders(sc, accountEntry.KeyId) | ||
| if err != nil { | ||
| return nil, fmt.Errorf("failed loading orders for account %q: %w", accountEntry.KeyId, err) | ||
| } | ||
|
|
||
| orderData := make([]map[string]interface{}, 0, len(orders)) | ||
| for _, order := range orders { | ||
| orderData = append(orderData, acmeOrderToDataMap(order)) | ||
| } | ||
|
|
||
| dataMap := acmeAccountToDataMap(accountEntry) | ||
| dataMap["orders"] = orderData | ||
| return &logical.Response{Data: dataMap}, nil | ||
| } | ||
|
|
||
| func (b *backend) pathAcmeMgmtUpdateAccount(ctx context.Context, r *logical.Request, d *framework.FieldData) (*logical.Response, error) { | ||
| keyId := d.Get("keyid").(string) | ||
| if len(keyId) == 0 { | ||
| return logical.ErrorResponse("keyid is required"), logical.ErrInvalidRequest | ||
| } | ||
|
|
||
| status, err := convertToAccountStatus(d.Get("status")) | ||
| if err != nil { | ||
| return logical.ErrorResponse(err.Error()), logical.ErrInvalidRequest | ||
| } | ||
| if status != AccountStatusValid && status != AccountStatusRevoked { | ||
| return logical.ErrorResponse("invalid status %q", status), logical.ErrInvalidRequest | ||
| } | ||
|
|
||
| sc := b.makeStorageContext(ctx, r.Storage) | ||
| as := b.GetAcmeState() | ||
|
|
||
| accountEntry, err := as.LoadAccountWithoutDirEnforcement(sc, keyId) | ||
| if err != nil { | ||
| if errors.Is(err, ErrAccountDoesNotExist) { | ||
| return logical.ErrorResponse("ACME key id %q did not exist", keyId), logical.ErrNotFound | ||
| } | ||
| return nil, fmt.Errorf("failed loading ACME account id %q: %w", keyId, err) | ||
| } | ||
|
|
||
| if accountEntry.Status != status { | ||
| accountEntry.Status = status | ||
|
|
||
| switch status { | ||
| case AccountStatusRevoked: | ||
| accountEntry.AccountRevokedDate = time.Now() | ||
| case AccountStatusValid: | ||
| accountEntry.AccountRevokedDate = time.Time{} | ||
| } | ||
|
|
||
| if err := as.UpdateAccount(sc, accountEntry); err != nil { | ||
| return nil, fmt.Errorf("failed saving account %q: %w", keyId, err) | ||
| } | ||
| } | ||
|
|
||
| dataMap := acmeAccountToDataMap(accountEntry) | ||
| return &logical.Response{Data: dataMap}, nil | ||
| } | ||
|
|
||
| func convertToAccountStatus(status any) (ACMEAccountStatus, error) { | ||
| if status == nil { | ||
| return "", fmt.Errorf("status is required") | ||
| } | ||
|
|
||
| statusStr, ok := status.(string) | ||
| if !ok { | ||
| return "", fmt.Errorf("status must be a string") | ||
| } | ||
|
|
||
| switch strings.ToLower(strings.TrimSpace(statusStr)) { | ||
| case AccountStatusValid.String(): | ||
| return AccountStatusValid, nil | ||
| case AccountStatusRevoked.String(): | ||
| return AccountStatusRevoked, nil | ||
| case AccountStatusDeactivated.String(): | ||
| return AccountStatusDeactivated, nil | ||
| default: | ||
| return "", fmt.Errorf("invalid status %q", statusStr) | ||
| } | ||
| } | ||
|
|
||
| func acmeAccountToDataMap(accountEntry *acmeAccount) map[string]interface{} { | ||
| revokedDate := "" | ||
| if !accountEntry.AccountRevokedDate.IsZero() { | ||
| revokedDate = accountEntry.AccountRevokedDate.Format(time.RFC3339) | ||
| } | ||
|
|
||
| eab := map[string]string{} | ||
| if accountEntry.Eab != nil { | ||
| eab["eab_id"] = accountEntry.Eab.KeyID | ||
| eab["directory"] = accountEntry.Eab.AcmeDirectory | ||
| eab["created_time"] = accountEntry.Eab.CreatedOn.Format(time.RFC3339) | ||
| eab["key_type"] = accountEntry.Eab.KeyType | ||
| } | ||
|
|
||
| return map[string]interface{}{ | ||
| "key_id": accountEntry.KeyId, | ||
| "status": accountEntry.Status, | ||
| "contacts": accountEntry.Contact, | ||
| "created_time": accountEntry.AccountCreatedDate.Format(time.RFC3339), | ||
| "revoked_time": revokedDate, | ||
| "directory": accountEntry.AcmeDirectory, | ||
| "eab": eab, | ||
| } | ||
| } | ||
|
|
||
| func acmeOrderToDataMap(order *acmeOrder) map[string]interface{} { | ||
| identifiers := make([]string, 0, len(order.Identifiers)) | ||
| for _, identifier := range order.Identifiers { | ||
| identifiers = append(identifiers, identifier.Value) | ||
| } | ||
| var certExpiry string | ||
| if !order.CertificateExpiry.IsZero() { | ||
| certExpiry = order.CertificateExpiry.Format(time.RFC3339) | ||
| } | ||
| return map[string]interface{}{ | ||
| "order_id": order.OrderId, | ||
| "status": string(order.Status), | ||
| "identifiers": identifiers, | ||
| "cert_serial_number": strings.ReplaceAll(order.CertificateSerialNumber, "-", ":"), | ||
| "cert_expiry": certExpiry, | ||
| "order_expiry": order.Expires.Format(time.RFC3339), | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.