v0,28,2

src/admin/certificates.rs

@@ -1,6 +1,7 @@
 async fn certificate_deploy(
     State(state): State<Arc<App>>,
     Extension(session): Extension<Session>,
+    certificate_api_access: Option<Extension<CertificateApiAccess>>,
     Json(input): Json<CertificateDeploy>,
 ) -> Result<Json<Value>, ApiError> {
     let directory = state.policy.cert_dir.clone().ok_or_else(|| {
@@ -21,6 +22,14 @@ async fn certificate_deploy(
             "invalid certificate id".into(),
         ));
     }
+    if let Some(Extension(access)) = certificate_api_access {
+        if !access.grant.allows_certificate(&certificate_id) {
+            return Err(ApiError(
+                StatusCode::FORBIDDEN,
+                "certificate_api.certificate_forbidden".into(),
+            ));
+        }
+    }
 
     let snapshot = state.config.load_full();
     let expected_revision = snapshot.envelope.revision;