feat(acme): Add ACME interfaces for Port80Handler and refactor ChallengeResponder to use new acme-interfaces, enhancing event subscription and certificate workflows.
This commit is contained in:
85
ts/http/port80/acme-interfaces.ts
Normal file
85
ts/http/port80/acme-interfaces.ts
Normal file
@ -0,0 +1,85 @@
|
||||
/**
|
||||
* Type definitions for SmartAcme interfaces used by ChallengeResponder
|
||||
* These reflect the actual SmartAcme API based on the documentation
|
||||
*/
|
||||
import * as plugins from '../../plugins.js';
|
||||
|
||||
/**
|
||||
* Structure for SmartAcme certificate result
|
||||
*/
|
||||
export interface SmartAcmeCert {
|
||||
id?: string;
|
||||
domainName: string;
|
||||
created?: number | Date | string;
|
||||
privateKey: string;
|
||||
publicKey: string;
|
||||
csr?: string;
|
||||
validUntil: number | Date | string;
|
||||
}
|
||||
|
||||
/**
|
||||
* Structure for SmartAcme options
|
||||
*/
|
||||
export interface SmartAcmeOptions {
|
||||
accountEmail: string;
|
||||
certManager: ICertManager;
|
||||
environment: 'production' | 'integration';
|
||||
challengeHandlers: IChallengeHandler<any>[];
|
||||
challengePriority?: string[];
|
||||
retryOptions?: {
|
||||
retries?: number;
|
||||
factor?: number;
|
||||
minTimeoutMs?: number;
|
||||
maxTimeoutMs?: number;
|
||||
};
|
||||
}
|
||||
|
||||
/**
|
||||
* Interface for certificate manager
|
||||
*/
|
||||
export interface ICertManager {
|
||||
init(): Promise<void>;
|
||||
get(domainName: string): Promise<SmartAcmeCert | null>;
|
||||
put(cert: SmartAcmeCert): Promise<SmartAcmeCert>;
|
||||
delete(domainName: string): Promise<void>;
|
||||
close?(): Promise<void>;
|
||||
}
|
||||
|
||||
/**
|
||||
* Interface for challenge handler
|
||||
*/
|
||||
export interface IChallengeHandler<T> {
|
||||
getSupportedTypes(): string[];
|
||||
prepare(ch: T): Promise<void>;
|
||||
verify?(ch: T): Promise<void>;
|
||||
cleanup(ch: T): Promise<void>;
|
||||
checkWetherDomainIsSupported(domain: string): Promise<boolean>;
|
||||
}
|
||||
|
||||
/**
|
||||
* HTTP-01 challenge type
|
||||
*/
|
||||
export interface Http01Challenge {
|
||||
type: string; // 'http-01'
|
||||
token: string;
|
||||
keyAuthorization: string;
|
||||
webPath: string;
|
||||
}
|
||||
|
||||
/**
|
||||
* HTTP-01 Memory Handler Interface
|
||||
*/
|
||||
export interface Http01MemoryHandler extends IChallengeHandler<Http01Challenge> {
|
||||
handleRequest(req: plugins.http.IncomingMessage, res: plugins.http.ServerResponse, next?: () => void): void;
|
||||
}
|
||||
|
||||
/**
|
||||
* SmartAcme main class interface
|
||||
*/
|
||||
export interface SmartAcme {
|
||||
start(): Promise<void>;
|
||||
stop(): Promise<void>;
|
||||
getCertificateForDomain(domain: string): Promise<SmartAcmeCert>;
|
||||
on?(event: string, listener: (data: any) => void): void;
|
||||
eventEmitter?: plugins.EventEmitter;
|
||||
}
|
||||
@ -1,20 +1,27 @@
|
||||
import * as plugins from '../../plugins.js';
|
||||
import { IncomingMessage, ServerResponse } from 'http';
|
||||
import {
|
||||
CertificateEvents
|
||||
import {
|
||||
CertificateEvents
|
||||
} from '../../certificate/events/certificate-events.js';
|
||||
import type {
|
||||
CertificateData,
|
||||
CertificateFailure,
|
||||
CertificateExpiring
|
||||
} from '../../certificate/models/certificate-types.js';
|
||||
import type {
|
||||
SmartAcme,
|
||||
SmartAcmeCert,
|
||||
SmartAcmeOptions,
|
||||
Http01MemoryHandler
|
||||
} from './acme-interfaces.js';
|
||||
|
||||
/**
|
||||
* Handles ACME HTTP-01 challenge responses
|
||||
* ChallengeResponder handles ACME HTTP-01 challenges by leveraging SmartAcme
|
||||
* It acts as a bridge between the HTTP server and the ACME challenge verification process
|
||||
*/
|
||||
export class ChallengeResponder extends plugins.EventEmitter {
|
||||
private smartAcme: plugins.smartacme.SmartAcme | null = null;
|
||||
private http01Handler: plugins.smartacme.handlers.Http01MemoryHandler | null = null;
|
||||
private smartAcme: SmartAcme | null = null;
|
||||
private http01Handler: Http01MemoryHandler | null = null;
|
||||
|
||||
/**
|
||||
* Creates a new challenge responder
|
||||
@ -35,198 +42,134 @@ export class ChallengeResponder extends plugins.EventEmitter {
|
||||
*/
|
||||
public async initialize(): Promise<void> {
|
||||
try {
|
||||
// Initialize HTTP-01 challenge handler
|
||||
// Create the HTTP-01 memory handler from SmartACME
|
||||
this.http01Handler = new plugins.smartacme.handlers.Http01MemoryHandler();
|
||||
|
||||
// Initialize SmartAcme with proper options
|
||||
this.smartAcme = new plugins.smartacme.SmartAcme({
|
||||
accountEmail: this.email,
|
||||
certManager: new plugins.smartacme.certmanagers.MemoryCertManager(),
|
||||
environment: this.useProduction ? 'production' : 'integration',
|
||||
challengeHandlers: [this.http01Handler],
|
||||
challengePriority: ['http-01'],
|
||||
});
|
||||
|
||||
// Ensure certificate store directory exists
|
||||
await this.ensureCertificateStore();
|
||||
|
||||
// Create a MemoryCertManager for certificate storage
|
||||
const certManager = new plugins.smartacme.certmanagers.MemoryCertManager();
|
||||
|
||||
// Initialize the SmartACME client with appropriate options
|
||||
this.smartAcme = new plugins.smartacme.SmartAcme({
|
||||
accountEmail: this.email,
|
||||
certManager: certManager,
|
||||
environment: this.useProduction ? 'production' : 'integration',
|
||||
challengeHandlers: [this.http01Handler],
|
||||
challengePriority: ['http-01']
|
||||
});
|
||||
|
||||
// Set up event forwarding from SmartAcme
|
||||
this.setupEventForwarding();
|
||||
|
||||
// Start SmartAcme
|
||||
this.setupEventListeners();
|
||||
|
||||
// Start the SmartACME client
|
||||
await this.smartAcme.start();
|
||||
console.log('ACME client initialized successfully');
|
||||
} catch (error) {
|
||||
throw new Error(`Failed to initialize ACME client: ${error instanceof Error ? error.message : String(error)}`);
|
||||
const errorMessage = error instanceof Error ? error.message : String(error);
|
||||
throw new Error(`Failed to initialize ACME client: ${errorMessage}`);
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Sets up event forwarding from SmartAcme to this component
|
||||
*/
|
||||
private setupEventForwarding(): void {
|
||||
if (!this.smartAcme) return;
|
||||
|
||||
// Cast smartAcme to any since different versions have different event APIs
|
||||
const smartAcmeAny = this.smartAcme as any;
|
||||
|
||||
// Forward certificate events to our own emitter
|
||||
if (typeof smartAcmeAny.on === 'function') {
|
||||
smartAcmeAny.on('certificate', (data: any) => {
|
||||
const certData: CertificateData = {
|
||||
domain: data.domain,
|
||||
certificate: data.cert || data.publicKey,
|
||||
privateKey: data.key || data.privateKey,
|
||||
expiryDate: new Date(data.expiryDate || data.validUntil),
|
||||
source: 'http01'
|
||||
};
|
||||
// Emit as issued or renewed based on the renewal flag
|
||||
const eventType = data.isRenewal
|
||||
? CertificateEvents.CERTIFICATE_RENEWED
|
||||
: CertificateEvents.CERTIFICATE_ISSUED;
|
||||
this.emit(eventType, certData);
|
||||
});
|
||||
|
||||
smartAcmeAny.on('error', (data: any) => {
|
||||
const failure: CertificateFailure = {
|
||||
domain: data.domain || 'unknown',
|
||||
error: data.message || data.toString(),
|
||||
isRenewal: false
|
||||
};
|
||||
this.emit(CertificateEvents.CERTIFICATE_FAILED, failure);
|
||||
});
|
||||
} else if (smartAcmeAny.eventEmitter && typeof smartAcmeAny.eventEmitter.on === 'function') {
|
||||
// Alternative event emitter approach for newer versions
|
||||
smartAcmeAny.eventEmitter.on('certificate', (data: any) => {
|
||||
const certData: CertificateData = {
|
||||
domain: data.domain,
|
||||
certificate: data.cert || data.publicKey,
|
||||
privateKey: data.key || data.privateKey,
|
||||
expiryDate: new Date(data.expiryDate || data.validUntil),
|
||||
source: 'http01'
|
||||
};
|
||||
const eventType = data.isRenewal
|
||||
? CertificateEvents.CERTIFICATE_RENEWED
|
||||
: CertificateEvents.CERTIFICATE_ISSUED;
|
||||
this.emit(eventType, certData);
|
||||
});
|
||||
|
||||
smartAcmeAny.eventEmitter.on('error', (data: any) => {
|
||||
const failure: CertificateFailure = {
|
||||
domain: data.domain || 'unknown',
|
||||
error: data.message || data.toString(),
|
||||
isRenewal: false
|
||||
};
|
||||
this.emit(CertificateEvents.CERTIFICATE_FAILED, failure);
|
||||
});
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Ensure certificate store directory exists
|
||||
* Ensure the certificate store directory exists
|
||||
*/
|
||||
private async ensureCertificateStore(): Promise<void> {
|
||||
try {
|
||||
await plugins.fs.promises.mkdir(this.certificateStore, { recursive: true });
|
||||
} catch (error) {
|
||||
throw new Error(`Failed to create certificate store: ${error instanceof Error ? error.message : String(error)}`);
|
||||
const errorMessage = error instanceof Error ? error.message : String(error);
|
||||
throw new Error(`Failed to create certificate store: ${errorMessage}`);
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Handle HTTP request and check if it's an ACME challenge
|
||||
* @param req HTTP request
|
||||
* @param res HTTP response
|
||||
* @returns true if the request was handled as an ACME challenge
|
||||
* Setup event listeners to forward SmartACME events to our own event emitter
|
||||
*/
|
||||
private setupEventListeners(): void {
|
||||
if (!this.smartAcme) return;
|
||||
|
||||
const setupEvents = (emitter: { on: (event: string, listener: (data: any) => void) => void }) => {
|
||||
// Forward certificate events
|
||||
emitter.on('certificate', (data: any) => {
|
||||
const isRenewal = !!data.isRenewal;
|
||||
|
||||
const certData: CertificateData = {
|
||||
domain: data.domainName || data.domain,
|
||||
certificate: data.publicKey || data.cert,
|
||||
privateKey: data.privateKey || data.key,
|
||||
expiryDate: new Date(data.validUntil || data.expiryDate || Date.now()),
|
||||
source: 'http01',
|
||||
isRenewal
|
||||
};
|
||||
|
||||
const eventType = isRenewal
|
||||
? CertificateEvents.CERTIFICATE_RENEWED
|
||||
: CertificateEvents.CERTIFICATE_ISSUED;
|
||||
|
||||
this.emit(eventType, certData);
|
||||
});
|
||||
|
||||
// Forward error events
|
||||
emitter.on('error', (error: any) => {
|
||||
const domain = error.domainName || error.domain || 'unknown';
|
||||
const failureData: CertificateFailure = {
|
||||
domain,
|
||||
error: error.message || String(error),
|
||||
isRenewal: !!error.isRenewal
|
||||
};
|
||||
|
||||
this.emit(CertificateEvents.CERTIFICATE_FAILED, failureData);
|
||||
});
|
||||
};
|
||||
|
||||
// Check for direct event methods on SmartAcme
|
||||
if (typeof this.smartAcme.on === 'function') {
|
||||
setupEvents(this.smartAcme as any);
|
||||
}
|
||||
// Check for eventEmitter property
|
||||
else if (this.smartAcme.eventEmitter) {
|
||||
setupEvents(this.smartAcme.eventEmitter);
|
||||
}
|
||||
// If no proper event handling, log a warning
|
||||
else {
|
||||
console.warn('SmartAcme instance does not support expected event interface - events may not be forwarded');
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Handle HTTP request by checking if it's an ACME challenge
|
||||
* @param req HTTP request object
|
||||
* @param res HTTP response object
|
||||
* @returns true if the request was handled, false otherwise
|
||||
*/
|
||||
public handleRequest(req: IncomingMessage, res: ServerResponse): boolean {
|
||||
if (!this.http01Handler) {
|
||||
return false;
|
||||
}
|
||||
if (!this.http01Handler) return false;
|
||||
|
||||
const url = req.url || '/';
|
||||
|
||||
// Check if this is an ACME challenge request
|
||||
// Check if this is an ACME challenge request (/.well-known/acme-challenge/*)
|
||||
const url = req.url || '';
|
||||
if (url.startsWith('/.well-known/acme-challenge/')) {
|
||||
const token = url.split('/').pop() || '';
|
||||
|
||||
if (token && this.http01Handler) {
|
||||
try {
|
||||
// Try to delegate to the handler - casting to any for flexibility
|
||||
const handler = this.http01Handler as any;
|
||||
|
||||
// Different versions may have different handler methods
|
||||
if (typeof handler.handleChallenge === 'function') {
|
||||
handler.handleChallenge(req, res);
|
||||
return true;
|
||||
} else if (typeof handler.handleRequest === 'function') {
|
||||
// Some versions use handleRequest instead
|
||||
handler.handleRequest(req, res);
|
||||
return true;
|
||||
} else {
|
||||
// Fall back to manual response
|
||||
const resp = this.getTokenResponse(token);
|
||||
if (resp) {
|
||||
res.setHeader('Content-Type', 'text/plain');
|
||||
res.setHeader('Cache-Control', 'no-store, no-cache, must-revalidate, max-age=0');
|
||||
res.writeHead(200);
|
||||
res.end(resp);
|
||||
return true;
|
||||
}
|
||||
}
|
||||
} catch (err) {
|
||||
// Challenge not found
|
||||
}
|
||||
try {
|
||||
// Delegate to the HTTP-01 memory handler, which knows how to serve challenges
|
||||
this.http01Handler.handleRequest(req, res);
|
||||
return true;
|
||||
} catch (error) {
|
||||
console.error('Error handling ACME challenge:', error);
|
||||
// If there was an error, send a 404 response
|
||||
res.writeHead(404);
|
||||
res.end('Not found');
|
||||
return true;
|
||||
}
|
||||
|
||||
// Invalid ACME challenge
|
||||
res.writeHead(404);
|
||||
res.end('Not found');
|
||||
return true;
|
||||
}
|
||||
|
||||
|
||||
return false;
|
||||
}
|
||||
|
||||
/**
|
||||
* Get the response for a specific token if available
|
||||
* This is a fallback method in case direct handler access isn't available
|
||||
*/
|
||||
private getTokenResponse(token: string): string | null {
|
||||
if (!this.http01Handler) return null;
|
||||
|
||||
try {
|
||||
// Cast to any to handle different versions of the API
|
||||
const handler = this.http01Handler as any;
|
||||
|
||||
// Try different methods that might be available in different versions
|
||||
if (typeof handler.getResponse === 'function') {
|
||||
return handler.getResponse(token);
|
||||
}
|
||||
|
||||
if (typeof handler.getChallengeVerification === 'function') {
|
||||
return handler.getChallengeVerification(token);
|
||||
}
|
||||
|
||||
// Try to access the challenges directly from the handler's internal state
|
||||
if (handler.challenges && typeof handler.challenges === 'object' && handler.challenges[token]) {
|
||||
return handler.challenges[token];
|
||||
}
|
||||
|
||||
// Try the token map if it exists (another common pattern)
|
||||
if (handler.tokenMap && typeof handler.tokenMap === 'object' && handler.tokenMap[token]) {
|
||||
return handler.tokenMap[token];
|
||||
}
|
||||
} catch (err) {
|
||||
console.error('Error getting token response:', err);
|
||||
}
|
||||
|
||||
return null;
|
||||
}
|
||||
|
||||
/**
|
||||
* Request a certificate for a domain
|
||||
* @param domain Domain name
|
||||
* @param isRenewal Whether this is a renewal
|
||||
* @param domain Domain name to request a certificate for
|
||||
* @param isRenewal Whether this is a renewal request
|
||||
*/
|
||||
public async requestCertificate(domain: string, isRenewal: boolean = false): Promise<CertificateData> {
|
||||
if (!this.smartAcme) {
|
||||
@ -234,9 +177,10 @@ export class ChallengeResponder extends plugins.EventEmitter {
|
||||
}
|
||||
|
||||
try {
|
||||
// Request certificate via SmartAcme
|
||||
// Request certificate using SmartACME
|
||||
const certObj = await this.smartAcme.getCertificateForDomain(domain);
|
||||
|
||||
// Convert the certificate object to our CertificateData format
|
||||
const certData: CertificateData = {
|
||||
domain,
|
||||
certificate: certObj.publicKey,
|
||||
@ -246,26 +190,19 @@ export class ChallengeResponder extends plugins.EventEmitter {
|
||||
isRenewal
|
||||
};
|
||||
|
||||
// SmartACME will emit its own events, but we'll emit our own too
|
||||
// for consistency with the rest of the system
|
||||
if (isRenewal) {
|
||||
this.emit(CertificateEvents.CERTIFICATE_RENEWED, certData);
|
||||
} else {
|
||||
this.emit(CertificateEvents.CERTIFICATE_ISSUED, certData);
|
||||
}
|
||||
|
||||
return certData;
|
||||
} catch (error) {
|
||||
// Construct failure object
|
||||
// Create failure object
|
||||
const failure: CertificateFailure = {
|
||||
domain,
|
||||
error: error instanceof Error ? error.message : String(error),
|
||||
isRenewal,
|
||||
isRenewal
|
||||
};
|
||||
|
||||
// Emit failure event
|
||||
this.emit(CertificateEvents.CERTIFICATE_FAILED, failure);
|
||||
|
||||
// Rethrow with more context
|
||||
throw new Error(`Failed to ${isRenewal ? 'renew' : 'obtain'} certificate for ${domain}: ${
|
||||
error instanceof Error ? error.message : String(error)
|
||||
}`);
|
||||
@ -273,19 +210,17 @@ export class ChallengeResponder extends plugins.EventEmitter {
|
||||
}
|
||||
|
||||
/**
|
||||
* Check if a certificate is expiring soon
|
||||
* Check if a certificate is expiring soon and trigger renewal if needed
|
||||
* @param domain Domain name
|
||||
* @param certificate Certificate data
|
||||
* @param thresholdDays Days before expiry to trigger a renewal
|
||||
* @param thresholdDays Days before expiry to trigger renewal
|
||||
*/
|
||||
public checkCertificateExpiry(
|
||||
domain: string,
|
||||
certificate: CertificateData,
|
||||
thresholdDays: number = 30
|
||||
): void {
|
||||
if (!certificate.expiryDate) {
|
||||
return;
|
||||
}
|
||||
if (!certificate.expiryDate) return;
|
||||
|
||||
const now = new Date();
|
||||
const expiryDate = certificate.expiryDate;
|
||||
@ -295,7 +230,7 @@ export class ChallengeResponder extends plugins.EventEmitter {
|
||||
const expiryInfo: CertificateExpiring = {
|
||||
domain,
|
||||
expiryDate,
|
||||
daysRemaining: daysDifference,
|
||||
daysRemaining: daysDifference
|
||||
};
|
||||
|
||||
this.emit(CertificateEvents.CERTIFICATE_EXPIRING, expiryInfo);
|
||||
|
||||
@ -550,6 +550,7 @@ export class Port80Handler extends plugins.EventEmitter {
|
||||
|
||||
try {
|
||||
// Request certificate via ChallengeResponder
|
||||
// The ChallengeResponder handles all ACME client interactions and will emit events
|
||||
const certData = await this.challengeResponder.requestCertificate(domain, isRenewal);
|
||||
|
||||
// Update domain info with certificate data
|
||||
@ -559,13 +560,9 @@ export class Port80Handler extends plugins.EventEmitter {
|
||||
domainInfo.expiryDate = certData.expiryDate;
|
||||
|
||||
console.log(`Certificate ${isRenewal ? 'renewed' : 'obtained'} for ${domain}`);
|
||||
|
||||
// The event will be emitted by the ChallengeResponder, we just store the certificate
|
||||
} catch (error: any) {
|
||||
const errorMsg = error instanceof Error ? error.message : String(error);
|
||||
console.error(`Error during certificate issuance for ${domain}:`, error);
|
||||
|
||||
// The failure event will be emitted by the ChallengeResponder
|
||||
throw new CertificateError(errorMsg, domain, isRenewal);
|
||||
} finally {
|
||||
domainInfo.obtainingInProgress = false;
|
||||
|
||||
Reference in New Issue
Block a user