Add ACME CA capabilities

acme/api/order.go

@@ -0,0 +1,164 @@
+package api
+
+import (
+	"crypto/x509"
+	"encoding/base64"
+	"encoding/json"
+	"net/http"
+	"time"
+
+	"github.com/go-chi/chi"
+	"github.com/pkg/errors"
+	"github.com/smallstep/certificates/acme"
+	"github.com/smallstep/certificates/api"
+)
+
+// NewOrderRequest represents the body for a NewOrder request.
+type NewOrderRequest struct {
+	Identifiers []acme.Identifier `json:"identifiers"`
+	NotBefore   time.Time         `json:"notBefore,omitempty"`
+	NotAfter    time.Time         `json:"notAfter,omitempty"`
+}
+
+// Validate validates a new-order request body.
+func (n *NewOrderRequest) Validate() error {
+	if len(n.Identifiers) == 0 {
+		return acme.MalformedErr(errors.Errorf("identifiers list cannot be empty"))
+	}
+	for _, id := range n.Identifiers {
+		if id.Type != "dns" {
+			return acme.MalformedErr(errors.Errorf("identifier type unsupported: %s", id.Type))
+		}
+	}
+	return nil
+}
+
+// FinalizeRequest captures the body for a Finalize order request.
+type FinalizeRequest struct {
+	CSR string `json:"csr"`
+	csr *x509.CertificateRequest
+}
+
+// Validate validates a finalize request body.
+func (f *FinalizeRequest) Validate() error {
+	var err error
+	csrBytes, err := base64.RawURLEncoding.DecodeString(f.CSR)
+	if err != nil {
+		return acme.MalformedErr(errors.Wrap(err, "error base64url decoding csr"))
+	}
+	f.csr, err = x509.ParseCertificateRequest(csrBytes)
+	if err != nil {
+		return acme.MalformedErr(errors.Wrap(err, "unable to parse csr"))
+	}
+	if err = f.csr.CheckSignature(); err != nil {
+		return acme.MalformedErr(errors.Wrap(err, "csr failed signature check"))
+	}
+	return nil
+}
+
+// NewOrder ACME api for creating a new order.
+func (h *Handler) NewOrder(w http.ResponseWriter, r *http.Request) {
+	prov, err := provisionerFromContext(r)
+	if err != nil {
+		api.WriteError(w, err)
+		return
+	}
+	acc, err := accountFromContext(r)
+	if err != nil {
+		api.WriteError(w, err)
+		return
+	}
+	payload, err := payloadFromContext(r)
+	if err != nil {
+		api.WriteError(w, err)
+		return
+	}
+	var nor NewOrderRequest
+	if err := json.Unmarshal(payload.value, &nor); err != nil {
+		api.WriteError(w, acme.MalformedErr(errors.Wrap(err,
+			"failed to unmarshal new-order request payload")))
+		return
+	}
+	if err := nor.Validate(); err != nil {
+		api.WriteError(w, err)
+		return
+	}
+
+	o, err := h.Auth.NewOrder(prov, acme.OrderOptions{
+		AccountID:   acc.GetID(),
+		Identifiers: nor.Identifiers,
+		NotBefore:   nor.NotBefore,
+		NotAfter:    nor.NotAfter,
+	})
+	if err != nil {
+		api.WriteError(w, err)
+		return
+	}
+
+	w.Header().Set("Location", h.Auth.GetLink(acme.OrderLink, acme.URLSafeProvisionerName(prov), true, o.GetID()))
+	api.JSONStatus(w, o, http.StatusCreated)
+	return
+}
+
+// GetOrder ACME api for retrieving an order.
+func (h *Handler) GetOrder(w http.ResponseWriter, r *http.Request) {
+	prov, err := provisionerFromContext(r)
+	if err != nil {
+		api.WriteError(w, err)
+		return
+	}
+	acc, err := accountFromContext(r)
+	if err != nil {
+		api.WriteError(w, err)
+		return
+	}
+	oid := chi.URLParam(r, "ordID")
+	o, err := h.Auth.GetOrder(prov, acc.GetID(), oid)
+	if err != nil {
+		api.WriteError(w, err)
+		return
+	}
+
+	w.Header().Set("Location", h.Auth.GetLink(acme.OrderLink, acme.URLSafeProvisionerName(prov), true, o.GetID()))
+	api.JSON(w, o)
+	return
+}
+
+// FinalizeOrder attemptst to finalize an order and create a certificate.
+func (h *Handler) FinalizeOrder(w http.ResponseWriter, r *http.Request) {
+	prov, err := provisionerFromContext(r)
+	if err != nil {
+		api.WriteError(w, err)
+		return
+	}
+	acc, err := accountFromContext(r)
+	if err != nil {
+		api.WriteError(w, err)
+		return
+	}
+	payload, err := payloadFromContext(r)
+	if err != nil {
+		api.WriteError(w, err)
+		return
+	}
+	var fr FinalizeRequest
+	if err := json.Unmarshal(payload.value, &fr); err != nil {
+		api.WriteError(w, acme.MalformedErr(errors.Wrap(err, "failed to unmarshal finalize-order request payload")))
+		return
+	}
+	if err := fr.Validate(); err != nil {
+		api.WriteError(w, err)
+		return
+	}
+
+	oid := chi.URLParam(r, "ordID")
+	o, err := h.Auth.FinalizeOrder(prov, acc.GetID(), oid, fr.csr)
+	if err != nil {
+		api.WriteError(w, err)
+		return
+	}
+
+	w.Header().Set("Location", h.Auth.GetLink(acme.OrderLink, acme.URLSafeProvisionerName(prov), true, o.ID))
+	api.JSON(w, o)
+	return
+}