0.31.9

src/admin/operations.rs

@@ -326,164 +326,6 @@ async fn certificate_upload(
     Ok(Json(json!({"certificate":certificate, "staged":true})))
 }
 
-#[derive(Deserialize)]
-#[serde(deny_unknown_fields)]
-struct CertificateApiRotate {
-    #[serde(default)]
-    key_id: Option<String>,
-    #[serde(default)]
-    token: Option<String>,
-    #[serde(default)]
-    comment: Option<String>,
-    #[serde(default)]
-    certificate_ids: Vec<String>,
-    #[serde(default)]
-    allow_deploy: bool,
-}
-
-fn valid_certificate_api_comment(value: &str) -> bool {
-    value.len() <= 256 && !value.chars().any(char::is_control)
-}
-
-fn certificate_api_status_value(values: Vec<crate::db::CertificateApiCredential>) -> Value {
-    let legacy = values.first();
-    json!({
-        "configured": !values.is_empty(),
-        "key_id": legacy.map(|value| value.key_id.clone()),
-        "created_at": legacy.map(|value| value.created_at),
-        "last_used_at": legacy.and_then(|value| value.last_used_at),
-        "credentials": values,
-        "max_credentials": crate::db::CERTIFICATE_API_CREDENTIAL_CAPACITY,
-        "scopes": ["certificates:deploy", "certificates:reload"],
-    })
-}
-
-async fn certificate_api_status(State(state): State<Arc<App>>) -> Result<Json<Value>, ApiError> {
-    let values = state
-        .store
-        .certificate_api_credentials()
-        .await
-        .map_err(auth::internal)?;
-    Ok(Json(certificate_api_status_value(values)))
-}
-
-async fn certificate_api_rotate(
-    State(state): State<Arc<App>>,
-    Extension(session): Extension<Session>,
-    Json(input): Json<CertificateApiRotate>,
-) -> Result<Json<Value>, ApiError> {
-    let generated = input.token.is_none();
-    let token = input.token.unwrap_or_else(auth::random_secret);
-    if !valid_certificate_api_token(&token) {
-        return Err(ApiError(
-            StatusCode::UNPROCESSABLE_ENTITY,
-            "certificate_api.invalid_token_format".into(),
-        ));
-    }
-    let key_id = input.key_id.unwrap_or_else(|| {
-        let random = auth::random_secret();
-        format!("certapi-{}", &random[..12])
-    });
-    if !valid_certificate_api_key_id(&key_id) {
-        return Err(ApiError(
-            StatusCode::UNPROCESSABLE_ENTITY,
-            "certificate_api.invalid_key_id".into(),
-        ));
-    }
-    let comment = input.comment.unwrap_or_default().trim().to_owned();
-    if !valid_certificate_api_comment(&comment) {
-        return Err(ApiError(
-            StatusCode::UNPROCESSABLE_ENTITY,
-            "certificate_api.invalid_comment".into(),
-        ));
-    }
-    let mut certificate_ids: Vec<String> = input
-        .certificate_ids
-        .into_iter()
-        .map(|value| value.trim().to_owned())
-        .filter(|value| !value.is_empty())
-        .collect();
-    certificate_ids.sort();
-    certificate_ids.dedup();
-    if certificate_ids.is_empty()
-        || certificate_ids.len() > 32
-        || certificate_ids
-            .iter()
-            .any(|value| value == "*" || !crate::config::valid_id(value))
-    {
-        return Err(ApiError(
-            StatusCode::UNPROCESSABLE_ENTITY,
-            "certificate_api.invalid_certificate_ids".into(),
-        ));
-    }
-    let token_hash = auth::secret_hash(&token);
-    let credential = state
-        .store
-        .upsert_certificate_api_credential(
-            &key_id,
-            &token_hash,
-            &comment,
-            input.allow_deploy,
-            &certificate_ids,
-            &session.username,
-        )
-        .await
-        .map_err(|error| {
-            if error.to_string().contains("credential limit reached") {
-                ApiError(StatusCode::CONFLICT, "certificate_api.limit_reached".into())
-            } else {
-                auth::internal(error)
-            }
-        })?;
-    let values = state
-        .store
-        .certificate_api_credentials()
-        .await
-        .map_err(auth::internal)?;
-    let mut value = certificate_api_status_value(values);
-    value["credential"] = serde_json::to_value(&credential).map_err(auth::internal)?;
-    value["token"] = Value::String(token);
-    value["generated"] = Value::Bool(generated);
-    Ok(Json(value))
-}
-
-async fn certificate_api_revoke(
-    State(state): State<Arc<App>>,
-    Extension(session): Extension<Session>,
-    Path(key_id): Path<String>,
-) -> Result<Json<Value>, ApiError> {
-    if !valid_certificate_api_key_id(&key_id) {
-        return Err(ApiError(
-            StatusCode::NOT_FOUND,
-            "certificate_api.not_found".into(),
-        ));
-    }
-    let revoked = state
-        .store
-        .revoke_certificate_api_credential(&key_id, &session.username)
-        .await
-        .map_err(auth::internal)?;
-    if !revoked {
-        return Err(ApiError(
-            StatusCode::NOT_FOUND,
-            "certificate_api.not_found".into(),
-        ));
-    }
-    Ok(Json(json!({"revoked": true, "key_id": key_id})))
-}
-
-async fn certificate_api_revoke_all(
-    State(state): State<Arc<App>>,
-    Extension(session): Extension<Session>,
-) -> Result<Json<Value>, ApiError> {
-    let revoked = state
-        .store
-        .revoke_all_certificate_api_credentials(&session.username)
-        .await
-        .map_err(auth::internal)?;
-    Ok(Json(json!({"configured": false, "revoked": revoked})))
-}
-
 #[derive(Deserialize)]
 #[serde(deny_unknown_fields)]
 struct CertificateDeploy {