Introduce generalized statusCoder errors and loads of ssh unit tests.

* StatusCoder api errors that have friendly user messages.
* Unit tests for SSH sign/renew/rekey/revoke across all provisioners.

api/api.go

@@ -5,7 +5,6 @@ import (
 	"crypto/dsa"
 	"crypto/ecdsa"
 	"crypto/rsa"
-	"crypto/tls"
 	"crypto/x509"
 	"encoding/asn1"
 	"encoding/base64"
@@ -209,14 +208,6 @@ type RootResponse struct {
 	RootPEM Certificate `json:"ca"`
 }
 
-// SignRequest is the request body for a certificate signature request.
-type SignRequest struct {
-	CsrPEM    CertificateRequest `json:"csr"`
-	OTT       string             `json:"ott"`
-	NotAfter  TimeDuration       `json:"notAfter"`
-	NotBefore TimeDuration       `json:"notBefore"`
-}
-
 // ProvisionersResponse is the response object that returns the list of
 // provisioners.
 type ProvisionersResponse struct {
@@ -230,31 +221,6 @@ type ProvisionerKeyResponse struct {
 	Key string `json:"key"`
 }
 
-// Validate checks the fields of the SignRequest and returns nil if they are ok
-// or an error if something is wrong.
-func (s *SignRequest) Validate() error {
-	if s.CsrPEM.CertificateRequest == nil {
-		return errs.BadRequest(errors.New("missing csr"))
-	}
-	if err := s.CsrPEM.CertificateRequest.CheckSignature(); err != nil {
-		return errs.BadRequest(errors.Wrap(err, "invalid csr"))
-	}
-	if s.OTT == "" {
-		return errs.BadRequest(errors.New("missing ott"))
-	}
-
-	return nil
-}
-
-// SignResponse is the response object of the certificate signature request.
-type SignResponse struct {
-	ServerPEM    Certificate          `json:"crt"`
-	CaPEM        Certificate          `json:"ca"`
-	CertChainPEM []Certificate        `json:"certChain"`
-	TLSOptions   *tlsutil.TLSOptions  `json:"tlsOptions,omitempty"`
-	TLS          *tls.ConnectionState `json:"-"`
-}
-
 // RootsResponse is the response object of the roots request.
 type RootsResponse struct {
 	Certificates []Certificate `json:"crts"`
@@ -344,80 +310,6 @@ func certChainToPEM(certChain []*x509.Certificate) []Certificate {
 	return certChainPEM
 }
 
-// Sign is an HTTP handler that reads a certificate request and an
-// one-time-token (ott) from the body and creates a new certificate with the
-// information in the certificate request.
-func (h *caHandler) Sign(w http.ResponseWriter, r *http.Request) {
-	var body SignRequest
-	if err := ReadJSON(r.Body, &body); err != nil {
-		WriteError(w, errs.BadRequest(errors.Wrap(err, "error reading request body")))
-		return
-	}
-
-	logOtt(w, body.OTT)
-	if err := body.Validate(); err != nil {
-		WriteError(w, err)
-		return
-	}
-
-	opts := provisioner.Options{
-		NotBefore: body.NotBefore,
-		NotAfter:  body.NotAfter,
-	}
-
-	signOpts, err := h.Authority.AuthorizeSign(body.OTT)
-	if err != nil {
-		WriteError(w, errs.Unauthorized(err))
-		return
-	}
-
-	certChain, err := h.Authority.Sign(body.CsrPEM.CertificateRequest, opts, signOpts...)
-	if err != nil {
-		WriteError(w, errs.Forbidden(err))
-		return
-	}
-	certChainPEM := certChainToPEM(certChain)
-	var caPEM Certificate
-	if len(certChainPEM) > 0 {
-		caPEM = certChainPEM[1]
-	}
-	logCertificate(w, certChain[0])
-	JSONStatus(w, &SignResponse{
-		ServerPEM:    certChainPEM[0],
-		CaPEM:        caPEM,
-		CertChainPEM: certChainPEM,
-		TLSOptions:   h.Authority.GetTLSOptions(),
-	}, http.StatusCreated)
-}
-
-// Renew uses the information of certificate in the TLS connection to create a
-// new one.
-func (h *caHandler) Renew(w http.ResponseWriter, r *http.Request) {
-	if r.TLS == nil || len(r.TLS.PeerCertificates) == 0 {
-		WriteError(w, errs.BadRequest(errors.New("missing peer certificate")))
-		return
-	}
-
-	certChain, err := h.Authority.Renew(r.TLS.PeerCertificates[0])
-	if err != nil {
-		WriteError(w, errs.Forbidden(err))
-		return
-	}
-	certChainPEM := certChainToPEM(certChain)
-	var caPEM Certificate
-	if len(certChainPEM) > 0 {
-		caPEM = certChainPEM[1]
-	}
-
-	logCertificate(w, certChain[0])
-	JSONStatus(w, &SignResponse{
-		ServerPEM:    certChainPEM[0],
-		CaPEM:        caPEM,
-		CertChainPEM: certChainPEM,
-		TLSOptions:   h.Authority.GetTLSOptions(),
-	}, http.StatusCreated)
-}
-
 // Provisioners returns the list of provisioners configured in the authority.
 func (h *caHandler) Provisioners(w http.ResponseWriter, r *http.Request) {
 	cursor, limit, err := parseCursor(r)