openhim-core/lib/api/certificateAuthority.js

The OpenHIM core application that provides logging and routing of http requests

"use strict";

Object.defineProperty(exports, "__esModule", {
  value: true
});
exports.generateCert = generateCert;

var _winston = _interopRequireDefault(require("winston"));

var _pem = _interopRequireDefault(require("pem"));

var _keystore = require("../model/keystore");

var utils = _interopRequireWildcard(require("../utils"));

var authorisation = _interopRequireWildcard(require("./authorisation"));

var _util = require("util");

function _getRequireWildcardCache() { if (typeof WeakMap !== "function") return null; var cache = new WeakMap(); _getRequireWildcardCache = function () { return cache; }; return cache; }

function _interopRequireWildcard(obj) { if (obj && obj.__esModule) { return obj; } if (obj === null || typeof obj !== "object" && typeof obj !== "function") { return { default: obj }; } var cache = _getRequireWildcardCache(); if (cache && cache.has(obj)) { return cache.get(obj); } var newObj = {}; var hasPropertyDescriptor = Object.defineProperty && Object.getOwnPropertyDescriptor; for (var key in obj) { if (Object.prototype.hasOwnProperty.call(obj, key)) { var desc = hasPropertyDescriptor ? Object.getOwnPropertyDescriptor(obj, key) : null; if (desc && (desc.get || desc.set)) { Object.defineProperty(newObj, key, desc); } else { newObj[key] = obj[key]; } } } newObj.default = obj; if (cache) { cache.set(obj, newObj); } return newObj; }

function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }

const readCertificateInfo = (0, _util.promisify)(_pem.default.readCertificateInfo);
const getFingerprint = (0, _util.promisify)(_pem.default.getFingerprint);

async function generateCert(ctx) {
  // Must be admin
  let result;

  if (authorisation.inGroup('admin', ctx.authenticated) === false) {
    utils.logAndSetResponse(ctx, 403, `User ${ctx.authenticated.email} is not an admin, API access to getServerKey by id denied.`, 'info');
    return;
  }

  const {
    request: {
      body: options
    }
  } = ctx;

  if (options.type === 'server') {
    _winston.default.info('Generating server cert');

    result = await generateServerCert(options, ctx);
  } else {
    _winston.default.info('Generating client cert');

    result = await generateClientCert(options, ctx);
  }

  ctx.status = 201;
  ctx.body = result;
}

async function generateClientCert(options, ctx) {
  const keystoreDoc = await _keystore.KeystoreModelAPI.findOne(); // Set additional options

  options.selfSigned = true; // Attempt to create the certificate

  try {
    ctx.body = await createCertificate(options);
    const certInfo = await extractCertMetadata(ctx.body.certificate, ctx);
    keystoreDoc.ca.push(certInfo);
    await keystoreDoc.save(); // Add the new certificate to the keystore

    ctx.status = 201;

    _winston.default.info('Client certificate created');
  } catch (err) {
    utils.logAndSetResponse(ctx, 'internal server error', `Could not create a client cert via the API: ${err}`, 'error');
  }

  return ctx.body;
}

async function generateServerCert(options, ctx) {
  const keystoreDoc = await _keystore.KeystoreModelAPI.findOne();
  options.selfSigned = true;

  try {
    ctx.body = await createCertificate(options);
    keystoreDoc.cert = await extractCertMetadata(ctx.body.certificate, ctx);
    keystoreDoc.key = ctx.body.key;
    await keystoreDoc.save(); // Add the new certificate to the keystore

    ctx.status = 201;

    _winston.default.info('Server certificate created');
  } catch (err) {
    utils.logAndSetResponse(ctx, 'internal server error', `Could not create a client cert via the API: ${err}`, 'error');
  }

  return ctx.body;
}

function createCertificate(options) {
  return new Promise((resolve, reject) => {
    _pem.default.createCertificate(options, (err, cert) => {
      if (err) {
        return reject(err);
      }

      resolve({
        certificate: cert.certificate,
        key: cert.clientKey
      });
    });
  });
}

async function extractCertMetadata(cert, ctx) {
  const certInfo = await readCertificateInfo(cert);
  const fingerprint = await getFingerprint(cert);
  certInfo.data = ctx.body.certificate;
  certInfo.fingerprint = fingerprint.fingerprint;
  return certInfo;
}
//# sourceMappingURL=certificateAuthority.js.map