2019-05-27 00:41:10 +00:00
|
|
|
package api
|
|
|
|
|
|
|
|
import (
|
|
|
|
"encoding/json"
|
|
|
|
"net/http"
|
|
|
|
|
2021-03-06 21:06:43 +00:00
|
|
|
"github.com/go-chi/chi"
|
2022-03-18 15:18:41 +00:00
|
|
|
|
2019-05-27 00:41:10 +00:00
|
|
|
"github.com/smallstep/certificates/acme"
|
2022-03-18 15:18:41 +00:00
|
|
|
"github.com/smallstep/certificates/api/render"
|
2019-05-27 00:41:10 +00:00
|
|
|
"github.com/smallstep/certificates/logging"
|
|
|
|
)
|
|
|
|
|
|
|
|
// NewAccountRequest represents the payload for a new account request.
|
|
|
|
type NewAccountRequest struct {
|
2021-08-10 10:39:11 +00:00
|
|
|
Contact []string `json:"contact"`
|
|
|
|
OnlyReturnExisting bool `json:"onlyReturnExisting"`
|
|
|
|
TermsOfServiceAgreed bool `json:"termsOfServiceAgreed"`
|
|
|
|
ExternalAccountBinding *ExternalAccountBinding `json:"externalAccountBinding,omitempty"`
|
2019-05-27 00:41:10 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
func validateContacts(cs []string) error {
|
|
|
|
for _, c := range cs {
|
2021-10-08 18:59:57 +00:00
|
|
|
if c == "" {
|
2021-03-03 23:16:25 +00:00
|
|
|
return acme.NewError(acme.ErrorMalformedType, "contact cannot be empty string")
|
2019-05-27 00:41:10 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
|
|
|
// Validate validates a new-account request body.
|
|
|
|
func (n *NewAccountRequest) Validate() error {
|
|
|
|
if n.OnlyReturnExisting && len(n.Contact) > 0 {
|
2021-03-03 23:16:25 +00:00
|
|
|
return acme.NewError(acme.ErrorMalformedType, "incompatible input; onlyReturnExisting must be alone")
|
2019-05-27 00:41:10 +00:00
|
|
|
}
|
|
|
|
return validateContacts(n.Contact)
|
|
|
|
}
|
|
|
|
|
|
|
|
// UpdateAccountRequest represents an update-account request.
|
|
|
|
type UpdateAccountRequest struct {
|
2021-03-05 07:10:46 +00:00
|
|
|
Contact []string `json:"contact"`
|
|
|
|
Status acme.Status `json:"status"`
|
2019-05-27 00:41:10 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
// Validate validates a update-account request body.
|
|
|
|
func (u *UpdateAccountRequest) Validate() error {
|
|
|
|
switch {
|
|
|
|
case len(u.Status) > 0 && len(u.Contact) > 0:
|
2021-03-03 23:16:25 +00:00
|
|
|
return acme.NewError(acme.ErrorMalformedType, "incompatible input; contact and "+
|
|
|
|
"status updates are mutually exclusive")
|
2019-05-27 00:41:10 +00:00
|
|
|
case len(u.Contact) > 0:
|
|
|
|
if err := validateContacts(u.Contact); err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
return nil
|
|
|
|
case len(u.Status) > 0:
|
2021-03-05 07:10:46 +00:00
|
|
|
if u.Status != acme.StatusDeactivated {
|
2021-03-03 23:16:25 +00:00
|
|
|
return acme.NewError(acme.ErrorMalformedType, "cannot update account "+
|
|
|
|
"status to %s, only deactivated", u.Status)
|
2019-05-27 00:41:10 +00:00
|
|
|
}
|
|
|
|
return nil
|
|
|
|
default:
|
2020-05-08 18:52:30 +00:00
|
|
|
// According to the ACME spec (https://tools.ietf.org/html/rfc8555#section-7.3.2)
|
|
|
|
// accountUpdate should ignore any fields not recognized by the server.
|
|
|
|
return nil
|
2019-05-27 00:41:10 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
// NewAccount is the handler resource for creating new ACME accounts.
|
|
|
|
func (h *Handler) NewAccount(w http.ResponseWriter, r *http.Request) {
|
2021-03-05 07:14:56 +00:00
|
|
|
ctx := r.Context()
|
|
|
|
payload, err := payloadFromContext(ctx)
|
2019-05-27 00:41:10 +00:00
|
|
|
if err != nil {
|
2022-03-18 15:35:23 +00:00
|
|
|
render.Error(w, err)
|
2019-05-27 00:41:10 +00:00
|
|
|
return
|
|
|
|
}
|
|
|
|
var nar NewAccountRequest
|
|
|
|
if err := json.Unmarshal(payload.value, &nar); err != nil {
|
2022-03-18 15:35:23 +00:00
|
|
|
render.Error(w, acme.WrapError(acme.ErrorMalformedType, err,
|
2021-03-03 23:16:25 +00:00
|
|
|
"failed to unmarshal new-account request payload"))
|
2019-05-27 00:41:10 +00:00
|
|
|
return
|
|
|
|
}
|
|
|
|
if err := nar.Validate(); err != nil {
|
2022-03-18 15:35:23 +00:00
|
|
|
render.Error(w, err)
|
2019-05-27 00:41:10 +00:00
|
|
|
return
|
|
|
|
}
|
|
|
|
|
2021-08-09 08:26:31 +00:00
|
|
|
prov, err := acmeProvisionerFromContext(ctx)
|
|
|
|
if err != nil {
|
2022-03-18 15:35:23 +00:00
|
|
|
render.Error(w, err)
|
2021-08-09 08:26:31 +00:00
|
|
|
return
|
|
|
|
}
|
|
|
|
|
2019-05-27 00:41:10 +00:00
|
|
|
httpStatus := http.StatusCreated
|
2021-12-07 11:17:41 +00:00
|
|
|
acc, err := accountFromContext(ctx)
|
2019-05-27 00:41:10 +00:00
|
|
|
if err != nil {
|
|
|
|
acmeErr, ok := err.(*acme.Error)
|
2020-02-02 01:35:41 +00:00
|
|
|
if !ok || acmeErr.Status != http.StatusBadRequest {
|
2019-05-27 00:41:10 +00:00
|
|
|
// Something went wrong ...
|
2022-03-18 15:35:23 +00:00
|
|
|
render.Error(w, err)
|
2019-05-27 00:41:10 +00:00
|
|
|
return
|
|
|
|
}
|
|
|
|
|
|
|
|
// Account does not exist //
|
|
|
|
if nar.OnlyReturnExisting {
|
2022-03-18 15:35:23 +00:00
|
|
|
render.Error(w, acme.NewError(acme.ErrorAccountDoesNotExistType,
|
2021-03-03 23:16:25 +00:00
|
|
|
"account does not exist"))
|
2019-05-27 00:41:10 +00:00
|
|
|
return
|
|
|
|
}
|
2021-12-07 11:17:41 +00:00
|
|
|
|
2021-03-05 07:14:56 +00:00
|
|
|
jwk, err := jwkFromContext(ctx)
|
2019-05-27 00:41:10 +00:00
|
|
|
if err != nil {
|
2022-03-18 15:35:23 +00:00
|
|
|
render.Error(w, err)
|
2019-05-27 00:41:10 +00:00
|
|
|
return
|
|
|
|
}
|
|
|
|
|
2021-12-07 11:17:41 +00:00
|
|
|
eak, err := h.validateExternalAccountBinding(ctx, &nar)
|
|
|
|
if err != nil {
|
2022-03-18 15:35:23 +00:00
|
|
|
render.Error(w, err)
|
2021-12-07 11:17:41 +00:00
|
|
|
return
|
|
|
|
}
|
|
|
|
|
2021-03-11 21:10:14 +00:00
|
|
|
acc = &acme.Account{
|
2019-05-27 00:41:10 +00:00
|
|
|
Key: jwk,
|
|
|
|
Contact: nar.Contact,
|
2021-03-01 06:49:20 +00:00
|
|
|
Status: acme.StatusValid,
|
2021-03-05 07:10:46 +00:00
|
|
|
}
|
2021-03-05 07:14:56 +00:00
|
|
|
if err := h.db.CreateAccount(ctx, acc); err != nil {
|
2022-03-18 15:35:23 +00:00
|
|
|
render.Error(w, acme.WrapErrorISE(err, "error creating account"))
|
2019-05-27 00:41:10 +00:00
|
|
|
return
|
|
|
|
}
|
2021-12-07 11:17:41 +00:00
|
|
|
|
2021-07-22 21:48:41 +00:00
|
|
|
if eak != nil { // means that we have a (valid) External Account Binding key that should be bound, updated and sent in the response
|
2021-10-08 11:18:23 +00:00
|
|
|
err := eak.BindTo(acc)
|
|
|
|
if err != nil {
|
2022-03-18 15:35:23 +00:00
|
|
|
render.Error(w, err)
|
2021-10-08 11:18:23 +00:00
|
|
|
return
|
|
|
|
}
|
2022-01-07 15:59:55 +00:00
|
|
|
if err := h.db.UpdateExternalAccountKey(ctx, prov.ID, eak); err != nil {
|
2022-03-18 15:35:23 +00:00
|
|
|
render.Error(w, acme.WrapErrorISE(err, "error updating external account binding key"))
|
2021-07-17 17:02:47 +00:00
|
|
|
return
|
|
|
|
}
|
|
|
|
acc.ExternalAccountBinding = nar.ExternalAccountBinding
|
|
|
|
}
|
2019-05-27 00:41:10 +00:00
|
|
|
} else {
|
2021-07-22 21:48:41 +00:00
|
|
|
// Account exists
|
2019-05-27 00:41:10 +00:00
|
|
|
httpStatus = http.StatusOK
|
|
|
|
}
|
|
|
|
|
2021-03-05 07:10:46 +00:00
|
|
|
h.linker.LinkAccount(ctx, acc)
|
|
|
|
|
2021-04-14 22:11:15 +00:00
|
|
|
w.Header().Set("Location", h.linker.GetLink(r.Context(), AccountLinkType, acc.ID))
|
2022-03-18 15:18:41 +00:00
|
|
|
render.JSONStatus(w, acc, httpStatus)
|
2019-05-27 00:41:10 +00:00
|
|
|
}
|
|
|
|
|
2021-04-13 02:06:07 +00:00
|
|
|
// GetOrUpdateAccount is the api for updating an ACME account.
|
|
|
|
func (h *Handler) GetOrUpdateAccount(w http.ResponseWriter, r *http.Request) {
|
2021-03-05 07:14:56 +00:00
|
|
|
ctx := r.Context()
|
|
|
|
acc, err := accountFromContext(ctx)
|
2019-05-27 00:41:10 +00:00
|
|
|
if err != nil {
|
2022-03-18 15:35:23 +00:00
|
|
|
render.Error(w, err)
|
2019-05-27 00:41:10 +00:00
|
|
|
return
|
|
|
|
}
|
2021-03-05 07:14:56 +00:00
|
|
|
payload, err := payloadFromContext(ctx)
|
2019-05-27 00:41:10 +00:00
|
|
|
if err != nil {
|
2022-03-18 15:35:23 +00:00
|
|
|
render.Error(w, err)
|
2019-05-27 00:41:10 +00:00
|
|
|
return
|
|
|
|
}
|
|
|
|
|
2020-05-08 18:52:30 +00:00
|
|
|
// If PostAsGet just respond with the account, otherwise process like a
|
|
|
|
// normal Post request.
|
2019-05-27 00:41:10 +00:00
|
|
|
if !payload.isPostAsGet {
|
|
|
|
var uar UpdateAccountRequest
|
|
|
|
if err := json.Unmarshal(payload.value, &uar); err != nil {
|
2022-03-18 15:35:23 +00:00
|
|
|
render.Error(w, acme.WrapError(acme.ErrorMalformedType, err,
|
2021-03-03 23:16:25 +00:00
|
|
|
"failed to unmarshal new-account request payload"))
|
2019-05-27 00:41:10 +00:00
|
|
|
return
|
|
|
|
}
|
|
|
|
if err := uar.Validate(); err != nil {
|
2022-03-18 15:35:23 +00:00
|
|
|
render.Error(w, err)
|
2019-05-27 00:41:10 +00:00
|
|
|
return
|
|
|
|
}
|
2021-03-12 08:16:48 +00:00
|
|
|
if len(uar.Status) > 0 || len(uar.Contact) > 0 {
|
|
|
|
if len(uar.Status) > 0 {
|
|
|
|
acc.Status = uar.Status
|
|
|
|
} else if len(uar.Contact) > 0 {
|
|
|
|
acc.Contact = uar.Contact
|
|
|
|
}
|
|
|
|
|
|
|
|
if err := h.db.UpdateAccount(ctx, acc); err != nil {
|
2022-03-18 15:35:23 +00:00
|
|
|
render.Error(w, acme.WrapErrorISE(err, "error updating account"))
|
2021-03-12 08:16:48 +00:00
|
|
|
return
|
|
|
|
}
|
2019-05-27 00:41:10 +00:00
|
|
|
}
|
|
|
|
}
|
2021-03-05 07:10:46 +00:00
|
|
|
|
|
|
|
h.linker.LinkAccount(ctx, acc)
|
|
|
|
|
2021-04-14 22:11:15 +00:00
|
|
|
w.Header().Set("Location", h.linker.GetLink(ctx, AccountLinkType, acc.ID))
|
2022-03-18 15:18:41 +00:00
|
|
|
render.JSON(w, acc)
|
2019-05-27 00:41:10 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
func logOrdersByAccount(w http.ResponseWriter, oids []string) {
|
|
|
|
if rl, ok := w.(logging.ResponseLogger); ok {
|
|
|
|
m := map[string]interface{}{
|
|
|
|
"orders": oids,
|
|
|
|
}
|
|
|
|
rl.WithFields(m)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2021-03-09 06:35:57 +00:00
|
|
|
// GetOrdersByAccountID ACME api for retrieving the list of order urls belonging to an account.
|
|
|
|
func (h *Handler) GetOrdersByAccountID(w http.ResponseWriter, r *http.Request) {
|
2021-03-06 21:06:43 +00:00
|
|
|
ctx := r.Context()
|
|
|
|
acc, err := accountFromContext(ctx)
|
|
|
|
if err != nil {
|
2022-03-18 15:35:23 +00:00
|
|
|
render.Error(w, err)
|
2021-03-06 21:06:43 +00:00
|
|
|
return
|
|
|
|
}
|
|
|
|
accID := chi.URLParam(r, "accID")
|
|
|
|
if acc.ID != accID {
|
2022-03-18 15:35:23 +00:00
|
|
|
render.Error(w, acme.NewError(acme.ErrorUnauthorizedType, "account ID '%s' does not match url param '%s'", acc.ID, accID))
|
2021-03-06 21:06:43 +00:00
|
|
|
return
|
|
|
|
}
|
|
|
|
orders, err := h.db.GetOrdersByAccountID(ctx, acc.ID)
|
|
|
|
if err != nil {
|
2022-03-18 15:35:23 +00:00
|
|
|
render.Error(w, err)
|
2021-03-06 21:06:43 +00:00
|
|
|
return
|
|
|
|
}
|
|
|
|
|
|
|
|
h.linker.LinkOrdersByAccountID(ctx, orders)
|
|
|
|
|
2022-03-18 15:18:41 +00:00
|
|
|
render.JSON(w, orders)
|
2021-03-06 21:06:43 +00:00
|
|
|
logOrdersByAccount(w, orders)
|
2019-05-27 00:41:10 +00:00
|
|
|
}
|