Add domain info to db

.devcontainer/devcontainer.json

@@ -14,7 +14,7 @@
 	"forwardPorts": [3000, 5432, 8200],
 
 	// Use 'postCreateCommand' to run commands after the container is created.
-	"postCreateCommand": "bundle install && rake vault:setup",
+	"postCreateCommand": "bundle install && rake db:setup && rake vault:setup",
 
 	// Configure tool-specific properties.
 	// "customizations": {},

app/controllers/application_controller.rb

@@ -2,6 +2,7 @@ class ApplicationController < ActionController::API
   before_action :set_default_format
   rescue_from StandardError, with: :handle_standard_error
   rescue_from AuthError, with: :handle_auth_error
+  rescue_from BadRequestError, with: :handle_bad_request_error
   rescue_from ActionController::ParameterMissing, with: :handle_bad_request
 
   attr_reader :identity # decoded and verified JWT
@@ -29,7 +30,7 @@ def handle_auth_error(exception)
     render json: { error: "Unauthorized" }, status: :unauthorized
   end
 
-  def handle_bad_request(exception)
-    render json: { error: exception }, status: :bad_request
+  def handle_bad_request_error(exception)
+    render json: { error: exception.message }, status: :bad_request
   end
 end

app/controllers/certificates_controller.rb

@@ -4,10 +4,9 @@ class CertificatesController < ApplicationController
   def create
     req = CertIssueRequest.new(params_permitted)
     if !req.valid?
-      render json: { error: req.errors }, status: :bad_request
-      return
+      raise BadRequestError.new req.errors.full_messages
     end
-    result = IssueCert.call(request: req)
+    result = IssueCert.call(request: req, identity: @identity)
     if result.failure?
       raise StandardError.new result.message
     end

app/interactors/authenticate_request.rb

@@ -0,0 +1,7 @@
+class AuthenticateRequest
+  include Interactor
+
+  def call
+    Services::DomainOwnershipService.new.authorize!(context.identity, context.request)
+  end
+end

app/interactors/issue_cert.rb

@@ -1,5 +1,5 @@
 class IssueCert
   include Interactor::Organizer
 
-  organize CheckPolicy, ObtainCert, Log
+  organize AuthenticateRequest, ObtainCert, Log
 end

app/lib/bad_request_error.rb

@@ -0,0 +1,3 @@
+# Error representing a bad request
+class BadRequestError < StandardError
+end

app/lib/services/domain_ownership_service.rb

@@ -3,17 +3,18 @@ class DomainOwnershipService
     def authorize!(identity, cert_req)
       cert_req.fqdns.each do |fqdn|
         domain = get_domain_name(fqdn)
-        raise AuthError unless domain.owner == identity.subject ||
-                                (domain.group_delegation &&
-                                (domain.groups & identity.groups).any?)
+        raise AuthError unless domain.present? &&
+                               (domain.owner == identity.subject ||
+                               (domain.group_delegation &&
+                               (domain.groups & identity.groups).any?))
       end
       nil
     end
 
     private
 
     def get_domain_name(fqdn)
-      # TODO implement
+      Domain.where(fqdn: fqdn).first
     end
   end
 end

app/models/domain.rb

@@ -0,0 +1,10 @@
+class Domain < ApplicationRecord
+  serialize :groups, coder: YAML, type: Array
+  before_save :clean_groups
+
+  validates :fqdn, :owner, presence: true
+
+  def clean_groups
+    self.groups = groups.sort.uniq
+  end
+end

db/migrate/20240904175652_create_domains.rb

@@ -0,0 +1,12 @@
+class CreateDomains < ActiveRecord::Migration[7.2]
+  def change
+    create_table :domains do |t|
+      t.string :fqdn, null: false
+      t.string :owner, null: false
+      t.text :groups
+      t.boolean :group_delegation, default: false
+      t.timestamps
+      t.index :fqdn, unique: true
+    end
+  end
+end

db/seeds.rb

@@ -7,3 +7,8 @@
 #   ["Action", "Comedy", "Drama", "Horror"].each do |genre_name|
 #     MovieGenre.find_or_create_by!(name: genre_name)
 #   end
+
+# this seed is for development only
+if Rails.env.development?
+  Domain.first_or_create!(fqdn: "example.com", owner: "[email protected]")
+end

test/fixtures/domains.yml

@@ -0,0 +1,18 @@
+owner_match:
+  fqdn: example.com
+  owner: [email protected]
+  group_delegation: false
+
+group_match:
+  fqdn: example2.com
+  owner: [email protected]
+  group_delegation: true
+  groups:
+    - "group1"
+
+no_match:
+  fqdn: example3.com
+  owner: [email protected]
+  group_delegation: true
+  groups:
+    - "group3"

test/integration/certificates_controller_test.rb

@@ -12,7 +12,7 @@ class CertificatesControllerTest < ActionDispatch::IntegrationTest
     assert_response :unauthorized
   end
 
-  test "#create authorized" do
+  test "#create authorized as owner" do
     jwt = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJqb2huLmRvZUBleGFtcGxlLmNvbSIsIm5hbWUiOiJKb2huIERvZSIsImlhdCI6MTUxNjIzOTAyMiwiZ3JvdXBzIjpbImdyb3VwMSIsImdyb3VwMiJdLCJhdWQiOiJhc3RyYWwifQ.tfRLXmE_eq-piP88_clwPWrYfMAQbCJAeZQI6OFxZSI"
     post certificates_path, headers: { "Authorization" => "Bearer #{jwt}" },
          params: { cert_issue_request: { common_name: "example.com" } }
@@ -27,4 +27,27 @@ class CertificatesControllerTest < ActionDispatch::IntegrationTest
       assert_includes response.parsed_body.keys, key
     end
   end
+
+  test "#create authorized by group" do
+    jwt = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJqb2huLmRvZUBleGFtcGxlLmNvbSIsIm5hbWUiOiJKb2huIERvZSIsImlhdCI6MTUxNjIzOTAyMiwiZ3JvdXBzIjpbImdyb3VwMSIsImdyb3VwMiJdLCJhdWQiOiJhc3RyYWwifQ.tfRLXmE_eq-piP88_clwPWrYfMAQbCJAeZQI6OFxZSI"
+    post certificates_path, headers: { "Authorization" => "Bearer #{jwt}" },
+         params: { cert_issue_request: { common_name: "example2.com" } }
+    assert_response :success
+    %w[ ca_chain
+        certificate
+        expiration
+        issuing_ca
+        private_key
+        private_key_type
+        serial_number ].each do |key|
+      assert_includes response.parsed_body.keys, key
+    end
+  end
+
+  test "#create not authorized by group" do
+    jwt = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJqb2huLmRvZUBleGFtcGxlLmNvbSIsIm5hbWUiOiJKb2huIERvZSIsImlhdCI6MTUxNjIzOTAyMiwiZ3JvdXBzIjpbImdyb3VwMSIsImdyb3VwMiJdLCJhdWQiOiJhc3RyYWwifQ.tfRLXmE_eq-piP88_clwPWrYfMAQbCJAeZQI6OFxZSI"
+    post certificates_path, headers: { "Authorization" => "Bearer #{jwt}" },
+         params: { cert_issue_request: { common_name: "example3.com" } }
+    assert_response :unauthorized
+  end
 end

test/lib/services/domain_ownership_service_test.rb

@@ -3,7 +3,7 @@
 class DomainOwnershipServiceTest < ActiveSupport::TestCase
   def setup
     @identity = Identity.new(subject: "[email protected]", groups: [ "admin_group" ])
-    @domain = DomainInfo.new(owner: "[email protected]", group_delegation: false, groups: [ "admin_group" ])
+    @domain = Domain.new(owner: "[email protected]", group_delegation: false, groups: [ "admin_group" ])
   end
 
   test "#authorize! with matching owner" do

test/models/domain_test.rb

@@ -0,0 +1,40 @@
+# test/models/cert_issue_request_test.rb
+require "test_helper"
+
+class DomainTest < ActiveSupport::TestCase
+  def setup
+    @attributes = {
+      fqdn: "example4.com",
+      owner: "[email protected]"
+    }
+    @domain = Domain.new(@attributes)
+  end
+
+  test "#new should set attributes from attributes argument" do
+    @attributes.each do |key, value|
+      assert_equal value, @domain.send(key), "Attribute #{key} was not set correctly"
+    end
+  end
+
+  test "#valid? should be valid with valid attributes" do
+    assert @domain.valid?
+  end
+
+  test "#valid? should require an fqdn" do
+    @domain.fqdn = nil
+    assert_not @domain.valid?
+    assert_includes @domain.errors[:fqdn], "can't be blank"
+  end
+
+  test "#valid? should require an owner" do
+    @domain.owner = nil
+    assert_not @domain.valid?
+    assert_includes @domain.errors[:owner], "can't be blank"
+  end
+
+  test "before_save should sort and dedupe groups" do
+    @domain.groups = [ "two", "two", "one" ]
+    @domain.save
+    assert_equal [ "one", "two" ], @domain.groups
+  end
+end