openhim-core/lib/api/keystore.js

The OpenHIM core application that provides logging and routing of http requests

var Keystore, Q, authorisation, config, getCertKeyStatus, logger, pem, utils;

Keystore = require('../model/keystore').Keystore;

Q = require('q');

logger = require('winston');

authorisation = require('./authorisation');

pem = require('pem');

utils = require("../utils");

config = require("../config/config");

config.certificateManagement = config.get('certificateManagement');

exports.getServerCert = function*() {
  var err, error, keystoreDoc;
  if (authorisation.inGroup('admin', this.authenticated) === false) {
    utils.logAndSetResponse(this, 403, "User " + this.authenticated.email + " is not an admin, API access to getServerCert denied.", 'info');
    return;
  }
  try {
    keystoreDoc = (yield Keystore.findOne().lean('cert').exec());
    keystoreDoc.cert.watchFSForCert = config.certificateManagement.watchFSForCert;
    return this.body = keystoreDoc.cert;
  } catch (error) {
    err = error;
    return utils.logAndSetResponse(this, 500, "Could not fetch the server cert via the API: " + err, 'error');
  }
};

exports.getCACerts = function*() {
  var err, error, keystoreDoc;
  if (authorisation.inGroup('admin', this.authenticated) === false) {
    utils.logAndSetResponse(this, 403, "User " + this.authenticated.email + " is not an admin, API access to getCACerts denied.", 'info');
    return;
  }
  try {
    keystoreDoc = (yield Keystore.findOne().select('ca').exec());
    return this.body = keystoreDoc.ca;
  } catch (error) {
    err = error;
    return utils.logAndSetResponse(this, 500, "Could not fetch the ca certs trusted by this server via the API: " + err, 'error');
  }
};

exports.getCACert = function*(certId) {
  var cert, err, error, keystoreDoc;
  if (authorisation.inGroup('admin', this.authenticated) === false) {
    utils.logAndSetResponse(this, 403, "User " + this.authenticated.email + " is not an admin, API access to getCACert by id denied.", 'info');
    return;
  }
  try {
    keystoreDoc = (yield Keystore.findOne().select('ca').exec());
    cert = keystoreDoc.ca.id(certId);
    return this.body = cert;
  } catch (error) {
    err = error;
    return utils.logAndSetResponse(this, 500, "Could not fetch ca cert by id via the API: " + err, 'error');
  }
};

exports.setServerPassphrase = function*() {
  var err, error, keystoreDoc, passphrase;
  if (authorisation.inGroup('admin', this.authenticated) === false) {
    utils.logAndSetResponse(this, 403, "User " + this.authenticated.email + " is not an admin, API access to setServerPassphrase denied.", 'info');
    return;
  }
  try {
    passphrase = this.request.body.passphrase;
    keystoreDoc = (yield Keystore.findOne().exec());
    keystoreDoc.passphrase = passphrase;
    (yield Q.ninvoke(keystoreDoc, 'save'));
    return this.status = 201;
  } catch (error) {
    err = error;
    return utils.logAndSetResponse(this, 500, "Could not set the passphrase  via the API: " + err, 'error');
  }
};

exports.setServerCert = function*() {
  var cert, certInfo, err, error, error1, fingerprint, getFingerprint, keystoreDoc, passphrase, readCertificateInfo;
  if (authorisation.inGroup('admin', this.authenticated) === false) {
    utils.logAndSetResponse(this, 403, "User " + this.authenticated.email + " is not an admin, API access to setServerCert by id denied.", 'info');
    return;
  }
  if (config.certificateManagement.watchFSForCert) {
    utils.logAndSetResponse(this, 400, "Failed to upload server certificate: Uploading of certificate while watchFSForCert is true is not allowed.", "info");
    return;
  }
  try {
    cert = this.request.body.cert;
    passphrase = this.request.body.passphrase;
    readCertificateInfo = Q.denodeify(pem.readCertificateInfo);
    getFingerprint = Q.denodeify(pem.getFingerprint);
    try {
      certInfo = (yield readCertificateInfo(cert));
      fingerprint = (yield getFingerprint(cert));
    } catch (error) {
      err = error;
      return utils.logAndSetResponse(this, 400, "Could not add server cert via the API: " + err, 'error');
    }
    certInfo.data = cert;
    certInfo.fingerprint = fingerprint.fingerprint;
    keystoreDoc = (yield Keystore.findOne().exec());
    keystoreDoc.cert = certInfo;
    keystoreDoc.passphrase = passphrase;
    (yield Q.ninvoke(keystoreDoc, 'save'));
    return this.status = 201;
  } catch (error1) {
    err = error1;
    return utils.logAndSetResponse(this, 500, "Could not add server cert via the API: " + err, 'error');
  }
};

exports.setServerKey = function*() {
  var err, error, key, keystoreDoc, passphrase;
  if (authorisation.inGroup('admin', this.authenticated) === false) {
    utils.logAndSetResponse(this, 403, "User " + this.authenticated.email + " is not an admin, API access to getServerKey by id denied.", 'info');
    return;
  }
  try {
    key = this.request.body.key;
    passphrase = this.request.body.passphrase;
    keystoreDoc = (yield Keystore.findOne().exec());
    keystoreDoc.key = key;
    keystoreDoc.passphrase = passphrase;
    (yield Q.ninvoke(keystoreDoc, 'save'));
    return this.status = 201;
  } catch (error) {
    err = error;
    return utils.logAndSetResponse(this, 500, "Could not add server key via the API: " + err, 'error');
  }
};

exports.addTrustedCert = function*() {
  var cert, certInfo, certs, chain, err, error, error1, fingerprint, getFingerprint, i, invalidCert, j, keystoreDoc, len, len1, line, readCertificateInfo;
  if (authorisation.inGroup('admin', this.authenticated) === false) {
    utils.logAndSetResponse(this, 403, "User " + this.authenticated.email + " is not an admin, API access to addTrustedCert by id denied.", 'info');
    return;
  }
  try {
    invalidCert = false;
    chain = this.request.body.cert;
    certs = [];
    chain = chain.split("\n");
    cert = [];
    for (i = 0, len = chain.length; i < len; i++) {
      line = chain[i];
      if (!(line.length !== 0)) {
        continue;
      }
      cert.push(line);
      if (line.match(/-END CERTIFICATE-/)) {
        certs.push((cert.join("\n")) + "\n");
        cert = [];
      }
    }
    keystoreDoc = (yield Keystore.findOne().exec());
    readCertificateInfo = Q.denodeify(pem.readCertificateInfo);
    getFingerprint = Q.denodeify(pem.getFingerprint);
    if (certs.length < 1) {
      invalidCert = true;
    }
    for (j = 0, len1 = certs.length; j < len1; j++) {
      cert = certs[j];
      try {
        certInfo = (yield readCertificateInfo(cert));
        fingerprint = (yield getFingerprint(cert));
      } catch (error) {
        err = error;
        invalidCert = true;
        continue;
      }
      certInfo.data = cert;
      certInfo.fingerprint = fingerprint.fingerprint;
      keystoreDoc.ca.push(certInfo);
    }
    (yield Q.ninvoke(keystoreDoc, 'save'));
    if (invalidCert) {
      return utils.logAndSetResponse(this, 400, "Failed to add one more cert, are they valid? " + err, 'error');
    } else {
      return this.status = 201;
    }
  } catch (error1) {
    err = error1;
    return utils.logAndSetResponse(this, 500, "Could not add trusted cert via the API: " + err, 'error');
  }
};

exports.removeCACert = function*(certId) {
  var err, error, keystoreDoc;
  if (authorisation.inGroup('admin', this.authenticated) === false) {
    utils.logAndSetResponse(this, 403, "User " + this.authenticated.email + " is not an admin, API access to removeCACert by id denied.", 'info');
    return;
  }
  try {
    keystoreDoc = (yield Keystore.findOne().exec());
    keystoreDoc.ca.id(certId).remove();
    (yield Q.ninvoke(keystoreDoc, 'save'));
    return this.status = 200;
  } catch (error) {
    err = error;
    return utils.logAndSetResponse(this, 500, "Could not remove ca cert by id via the API: " + err, 'error');
  }
};

exports.verifyServerKeys = function*() {
  var err, error, error1, result;
  if (authorisation.inGroup('admin', this.authenticated) === false) {
    utils.logAndSetResponse(this, 403, "User " + this.authenticated.email + " is not an admin, API access to verifyServerKeys.", 'info');
    return;
  }
  try {
    try {
      result = (yield Q.nfcall(getCertKeyStatus));
    } catch (error) {
      err = error;
      return utils.logAndSetResponse(this, 400, "Could not verify certificate and key, are they valid? " + err, 'error');
    }
    this.body = {
      valid: result
    };
    return this.status = 200;
  } catch (error1) {
    err = error1;
    return utils.logAndSetResponse(this, 500, "Could not determine validity via the API: " + err, 'error');
  }
};

exports.getCertKeyStatus = getCertKeyStatus = function(callback) {
  return Keystore.findOne(function(err, keystoreDoc) {
    if (err) {
      return callback(err, null);
    }
    if (/Proc-Type:.*ENCRYPTED/.test(keystoreDoc.key) && ((keystoreDoc.passphrase == null) || keystoreDoc.passphrase.length === 0)) {
      return callback(null, false);
    }
    return pem.getModulusFromProtected(keystoreDoc.key, keystoreDoc.passphrase, function(err, keyModulus) {
      if (err) {
        return callback(err, null);
      }
      return pem.getModulus(keystoreDoc.cert.data, function(err, certModulus) {
        if (err) {
          return callback(err, null);
        }
        if (keyModulus.modulus === certModulus.modulus) {
          return callback(null, true);
        } else {
          return callback(null, false);
        }
      });
    });
  });
};

//# sourceMappingURL=keystore.js.map