openhim-core/lib/api/certificateAuthority.js

The OpenHIM core application that provides logging and routing of http requests

'use strict';

Object.defineProperty(exports, "__esModule", {
  value: true
});
exports.generateCert = generateCert;

var _winston = require('winston');

var _winston2 = _interopRequireDefault(_winston);

var _pem = require('pem');

var _pem2 = _interopRequireDefault(_pem);

var _keystore = require('../model/keystore');

var _utils = require('../utils');

var utils = _interopRequireWildcard(_utils);

var _authorisation = require('./authorisation');

var authorisation = _interopRequireWildcard(_authorisation);

var _util = require('util');

function _interopRequireWildcard(obj) { if (obj && obj.__esModule) { return obj; } else { var newObj = {}; if (obj != null) { for (var key in obj) { if (Object.prototype.hasOwnProperty.call(obj, key)) newObj[key] = obj[key]; } } newObj.default = obj; return newObj; } }

function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }

const readCertificateInfo = (0, _util.promisify)(_pem2.default.readCertificateInfo);
const getFingerprint = (0, _util.promisify)(_pem2.default.getFingerprint);

async function generateCert(ctx) {
  // Must be admin
  let result;
  if (authorisation.inGroup('admin', ctx.authenticated) === false) {
    utils.logAndSetResponse(ctx, 403, `User ${ctx.authenticated.email} is not an admin, API access to getServerKey by id denied.`, 'info');
    return;
  }
  const { request: { body: options } } = ctx;
  if (options.type === 'server') {
    _winston2.default.info('Generating server cert');
    result = await generateServerCert(options, ctx);
  } else {
    _winston2.default.info('Generating client cert');
    result = await generateClientCert(options, ctx);
  }
  ctx.status = 201;
  ctx.body = result;
}

async function generateClientCert(options, ctx) {
  const keystoreDoc = await _keystore.KeystoreModelAPI.findOne();

  // Set additional options
  options.selfSigned = true;

  // Attempt to create the certificate
  try {
    ctx.body = await createCertificate(options);
    const certInfo = await extractCertMetadata(ctx.body.certificate, ctx);
    keystoreDoc.ca.push(certInfo);
    await keystoreDoc.save();
    // Add the new certificate to the keystore
    ctx.status = 201;
    _winston2.default.info('Client certificate created');
  } catch (err) {
    utils.logAndSetResponse(ctx, 'internal server error', `Could not create a client cert via the API: ${err}`, 'error');
  }
  return ctx.body;
}

async function generateServerCert(options, ctx) {
  const keystoreDoc = await _keystore.KeystoreModelAPI.findOne();
  options.selfSigned = true;
  try {
    ctx.body = await createCertificate(options);
    keystoreDoc.cert = await extractCertMetadata(ctx.body.certificate, ctx);
    keystoreDoc.key = ctx.body.key;
    await keystoreDoc.save();
    // Add the new certificate to the keystore
    ctx.status = 201;
    _winston2.default.info('Server certificate created');
  } catch (err) {
    utils.logAndSetResponse(ctx, 'internal server error', `Could not create a client cert via the API: ${err}`, 'error');
  }
  return ctx.body;
}

function createCertificate(options) {
  return new Promise((resolve, reject) => {
    _pem2.default.createCertificate(options, (err, cert) => {
      if (err) {
        return reject(err);
      }
      resolve({
        certificate: cert.certificate,
        key: cert.clientKey
      });
    });
  });
}

async function extractCertMetadata(cert, ctx) {
  const certInfo = await readCertificateInfo(cert);
  const fingerprint = await getFingerprint(cert);
  certInfo.data = ctx.body.certificate;
  certInfo.fingerprint = fingerprint.fingerprint;
  return certInfo;
}
//# sourceMappingURL=certificateAuthority.js.map