root
/
acme.js
mirror of https://github.com/therootcompany/acme.js
2
0
Fork 1
Code Issues 8 Releases Wiki Activity

chore: npx -p prettier@3 -- prettier -w ./index.js

This commit is contained in:
AJ ONeal 2024-05-13 12:15:38 -06:00
parent b8e51c2308
commit 005b496054
Signed by: coolaj86
GPG Key ID: F1D692A76F70CF98
1 changed files with 124 additions and 136 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

260
index.js
View File

@ -19,7 +19,7 @@ ACME.splitPemChain = function splitPemChain(str) {
return str
.trim()
.split(/[\r\n]{2,}/g)
.map(function(str) {
.map(function (str) {
return str + '\n';
});
};
@ -31,14 +31,14 @@ ACME.challengePrefixes = {
'dns-01': '_acme-challenge'
};
ACME.challengeTests = {
'http-01': function(me, auth) {
'http-01': function (me, auth) {
var url =
'http://' +
auth.hostname +
ACME.challengePrefixes['http-01'] +
'/' +
auth.token;
return me._request({ url: url }).then(function(resp) {
return me._request({ url: url }).then(function (resp) {
var err;
// TODO limit the number of bytes that are allowed to be downloaded
@ -63,18 +63,18 @@ ACME.challengeTests = {
return Promise.reject(err);
});
},
'dns-01': function(me, auth) {
'dns-01': function (me, auth) {
// remove leading *. on wildcard domains
return me
._dig({
type: 'TXT',
name: auth.dnsHost
})
.then(function(ans) {
.then(function (ans) {
var err;
if (
ans.answer.some(function(txt) {
ans.answer.some(function (txt) {
return auth.dnsAuthorization === txt.data[0];
})
) {
@ -96,7 +96,7 @@ ACME.challengeTests = {
}
};
ACME._getUserAgentString = function(deps) {
ACME._getUserAgentString = function (deps) {
var uaDefaults = {
pkg: 'Greenlock/' + deps.pkg.version,
os:
@ -116,7 +116,7 @@ ACME._getUserAgentString = function(deps) {
var userAgent = [];
//Object.keys(currentUAProps)
Object.keys(uaDefaults).forEach(function(key) {
Object.keys(uaDefaults).forEach(function (key) {
if (uaDefaults[key]) {
userAgent.push(uaDefaults[key]);
}
@ -124,19 +124,19 @@ ACME._getUserAgentString = function(deps) {
return userAgent.join(' ').trim();
};
ACME._directory = function(me) {
ACME._directory = function (me) {
return me._request({ url: me.directoryUrl, json: true });
};
ACME._getNonce = function(me) {
ACME._getNonce = function (me) {
if (me._nonce) {
return new Promise(function(resolve) {
return new Promise(function (resolve) {
resolve(me._nonce);
return;
});
}
return me
._request({ method: 'HEAD', url: me._directoryUrls.newNonce })
.then(function(resp) {
.then(function (resp) {
me._nonce = resp.toJSON().headers['replay-nonce'];
return me._nonce;
});
@ -161,13 +161,13 @@ ACME._getNonce = function(me) {
"signature": "RZPOnYoPs1PhjszF...-nh6X1qtOFPB519I"
}
*/
ACME._registerAccount = function(me, options) {
ACME._registerAccount = function (me, options) {
if (me.debug) {
console.debug('[acme-v2] accounts.create');
}
return ACME._getNonce(me).then(function() {
return new Promise(function(resolve, reject) {
return ACME._getNonce(me).then(function () {
return new Promise(function (resolve, reject) {
function agree(tosUrl) {
var err;
if (me._tos !== tosUrl) {
@ -230,7 +230,7 @@ ACME._registerAccount = function(me, options) {
headers: { 'Content-Type': 'application/jose+json' },
json: jws
})
.then(function(resp) {
.then(function (resp) {
var account = resp.body;
if (2 !== Math.floor(resp.statusCode / 100)) {
@ -292,7 +292,7 @@ ACME._registerAccount = function(me, options) {
);
} else if (2 === options.agreeToTerms.length) {
// backwards compat cb API
return options.agreeToTerms(me._tos, function(err, tosUrl) {
return options.agreeToTerms(me._tos, function (err, tosUrl) {
if (!err) {
agree(tosUrl);
return;
@ -330,26 +330,24 @@ ACME._registerAccount = function(me, options) {
"signature": "H6ZXtGjTZyUnPeKn...wEA4TklBdh3e454g"
}
*/
ACME._getChallenges = function(me, options, auth) {
ACME._getChallenges = function (me, options, auth) {
if (me.debug) {
console.debug('\n[DEBUG] getChallenges\n');
}
return me
._request({ method: 'GET', url: auth, json: true })
.then(function(resp) {
.then(function (resp) {
return resp.body;
});
};
ACME._wait = function wait(ms) {
return new Promise(function(resolve) {
return new Promise(function (resolve) {
setTimeout(resolve, ms || 1100);
});
};
ACME._testChallengeOptions = function() {
var chToken = require('crypto')
.randomBytes(16)
.toString('hex');
ACME._testChallengeOptions = function () {
var chToken = require('crypto').randomBytes(16).toString('hex');
return [
{
type: 'http-01',
@ -378,18 +376,18 @@ ACME._testChallengeOptions = function() {
}
];
};
ACME._testChallenges = function(me, options) {
ACME._testChallenges = function (me, options) {
if (me.skipChallengeTest) {
return Promise.resolve();
}
var CHECK_DELAY = 0;
return Promise.all(
options.domains.map(function(identifierValue) {
options.domains.map(function (identifierValue) {
// TODO we really only need one to pass, not all to pass
var challenges = ACME._testChallengeOptions();
if (identifierValue.includes('*')) {
challenges = challenges.filter(function(ch) {
challenges = challenges.filter(function (ch) {
return ch._wildcard;
});
}
@ -402,7 +400,7 @@ ACME._testChallenges = function(me, options) {
var enabled = options.challengeTypes.join(', ') || 'none';
var suitable =
challenges
.map(function(r) {
.map(function (r) {
return r.type;
})
.join(', ') || 'none';
@ -425,7 +423,7 @@ ACME._testChallenges = function(me, options) {
CHECK_DELAY = 1.5 * 1000;
}
return Promise.resolve().then(function() {
return Promise.resolve().then(function () {
var results = {
identifier: {
type: 'dns',
@ -443,27 +441,27 @@ ACME._testChallenges = function(me, options) {
challenge,
dryrun
);
return ACME._setChallenge(me, options, auth).then(function() {
return ACME._setChallenge(me, options, auth).then(function () {
return auth;
});
});
})
).then(function(auths) {
return ACME._wait(CHECK_DELAY).then(function() {
).then(function (auths) {
return ACME._wait(CHECK_DELAY).then(function () {
return Promise.all(
auths.map(function(auth) {
auths.map(function (auth) {
return ACME.challengeTests[auth.type](me, auth);
})
);
});
});
};
ACME._chooseChallenge = function(options, results) {
ACME._chooseChallenge = function (options, results) {
// For each of the challenge types that we support
var challenge;
options.challengeTypes.some(function(chType) {
options.challengeTypes.some(function (chType) {
// And for each of the challenge types that are allowed
return results.challenges.some(function(ch) {
return results.challenges.some(function (ch) {
// Check to see if there are any matches
if (ch.type === chType) {
challenge = ch;
@ -474,9 +472,9 @@ ACME._chooseChallenge = function(options, results) {
return challenge;
};
ACME._depInit = function(me, options) {
ACME._depInit = function (me, options) {
if ('function' !== typeof options.init) {
options.init = function() {
options.init = function () {
return Promise.resolve(null);
};
}
@ -489,9 +487,9 @@ ACME._depInit = function(me, options) {
'null'
);
};
ACME._getZones = function(me, options, dnsHosts) {
ACME._getZones = function (me, options, dnsHosts) {
if ('function' !== typeof options.getZones) {
options.getZones = function() {
options.getZones = function () {
return Promise.resolve([]);
};
}
@ -507,15 +505,15 @@ ACME._getZones = function(me, options, dnsHosts) {
);
};
ACME._wrapCb = function(me, options, _name, stuff, _desc) {
return new Promise(function(resolve, reject) {
ACME._wrapCb = function (me, options, _name, stuff, _desc) {
return new Promise(function (resolve, reject) {
try {
if (options[_name].length <= 1) {
return Promise.resolve(options[_name](stuff))
.then(resolve)
.catch(reject);
} else if (2 === options[_name].length) {
options[_name](stuff, function(err, zonenames) {
options[_name](stuff, function (err, zonenames) {
if (err) {
reject(err);
} else {
@ -544,26 +542,23 @@ function newZoneRegExp(zonename) {
}
function pluckZone(zonenames, dnsHost) {
return zonenames
.filter(function(zonename) {
.filter(function (zonename) {
// the only character that needs to be escaped for regex
// and is allowed in a domain name is '.'
return newZoneRegExp(zonename).test(dnsHost);
})
.sort(function(a, b) {
.sort(function (a, b) {
// longest match first
return b.length - a.length;
})[0];
}
ACME._challengeToAuth = function(me, options, request, challenge, dryrun) {
ACME._challengeToAuth = function (me, options, request, challenge, dryrun) {
// we don't poison the dns cache with our dummy request
var dnsPrefix = ACME.challengePrefixes['dns-01'];
if (dryrun) {
dnsPrefix = dnsPrefix.replace(
'acme-challenge',
'greenlock-dryrun-' +
Math.random()
.toString()
.slice(2, 6)
'greenlock-dryrun-' + Math.random().toString().slice(2, 6)
);
}
@ -571,14 +566,14 @@ ACME._challengeToAuth = function(me, options, request, challenge, dryrun) {
// straight copy from the new order response
// { identifier, status, expires, challenges, wildcard }
Object.keys(request).forEach(function(key) {
Object.keys(request).forEach(function (key) {
auth[key] = request[key];
});
// copy from the challenge we've chosen
// { type, status, url, token }
// (note the duplicate status overwrites the one above, but they should be the same)
Object.keys(challenge).forEach(function(key) {
Object.keys(challenge).forEach(function (key) {
// don't confused devs with the id url
auth[key] = challenge[key];
});
@ -618,7 +613,7 @@ ACME._challengeToAuth = function(me, options, request, challenge, dryrun) {
return auth;
};
ACME._untame = function(name, wild) {
ACME._untame = function (name, wild) {
if (wild) {
name = '*.' + name.replace('*.', '');
}
@ -626,7 +621,7 @@ ACME._untame = function(name, wild) {
};
// https://tools.ietf.org/html/draft-ietf-acme-acme-10#section-7.5.1
ACME._postChallenge = function(me, options, auth) {
ACME._postChallenge = function (me, options, auth) {
var RETRY_INTERVAL = me.retryInterval || 1000;
var DEAUTH_INTERVAL = me.deauthWait || 10 * 1000;
var MAX_POLL = me.retryPoll || 8;
@ -673,7 +668,7 @@ ACME._postChallenge = function(me, options, auth) {
headers: { 'Content-Type': 'application/jose+json' },
json: jws
})
.then(function(resp) {
.then(function (resp) {
if (me.debug) {
console.debug('[acme-v2.js] deactivate:');
}
@ -716,7 +711,7 @@ ACME._postChallenge = function(me, options, auth) {
}
return me
._request({ method: 'GET', url: auth.url, json: true })
.then(function(resp) {
.then(function (resp) {
if ('processing' === resp.body.status) {
if (me.debug) {
console.debug('poll: again');
@ -744,9 +739,12 @@ ACME._postChallenge = function(me, options, auth) {
try {
if (1 === options.removeChallenge.length) {
options.removeChallenge(auth).then(function() {}, function() {});
options.removeChallenge(auth).then(
function () {},
function () {}
);
} else if (2 === options.removeChallenge.length) {
options.removeChallenge(auth, function(err) {
options.removeChallenge(auth, function (err) {
return err;
});
} else {
@ -762,7 +760,7 @@ ACME._postChallenge = function(me, options, auth) {
options.removeChallenge(
auth.request.identifier,
auth.token,
function() {}
function () {}
);
}
} catch (e) {}
@ -815,7 +813,7 @@ ACME._postChallenge = function(me, options, auth) {
headers: { 'Content-Type': 'application/jose+json' },
json: jws
})
.then(function(resp) {
.then(function (resp) {
if (me.debug) {
console.debug('[acme-v2.js] challenge accepted!');
}
@ -842,16 +840,13 @@ ACME._postChallenge = function(me, options, auth) {
return respondToChallenge();
};
ACME._setChallenge = function(me, options, auth) {
return new Promise(function(resolve, reject) {
ACME._setChallenge = function (me, options, auth) {
return new Promise(function (resolve, reject) {
try {
if (1 === options.setChallenge.length) {
options
.setChallenge(auth)
.then(resolve)
.catch(reject);
options.setChallenge(auth).then(resolve).catch(reject);
} else if (2 === options.setChallenge.length) {
options.setChallenge(auth, function(err) {
options.setChallenge(auth, function (err) {
if (err) {
reject(err);
} else {
@ -859,7 +854,7 @@ ACME._setChallenge = function(me, options, auth) {
}
});
} else {
var challengeCb = function(err) {
var challengeCb = function (err) {
if (err) {
reject(err);
} else {
@ -867,7 +862,7 @@ ACME._setChallenge = function(me, options, auth) {
}
};
// for backwards compat adding extra keys without changing params length
Object.keys(auth).forEach(function(key) {
Object.keys(auth).forEach(function (key) {
challengeCb[key] = auth[key];
});
if (!ACME._setChallengeWarn) {
@ -889,7 +884,7 @@ ACME._setChallenge = function(me, options, auth) {
} catch (e) {
reject(e);
}
}).then(function() {
}).then(function () {
// TODO: Do we still need this delay? Or shall we leave it to plugins to account for themselves?
var DELAY = me.setChallengeWait || 500;
if (me.debug) {
@ -898,7 +893,7 @@ ACME._setChallenge = function(me, options, auth) {
return ACME._wait(DELAY);
});
};
ACME._finalizeOrder = function(me, options, validatedDomains) {
ACME._finalizeOrder = function (me, options, validatedDomains) {
if (me.debug) {
console.debug('finalizeOrder:');
}
@ -930,7 +925,7 @@ ACME._finalizeOrder = function(me, options, validatedDomains) {
headers: { 'Content-Type': 'application/jose+json' },
json: jws
})
.then(function(resp) {
.then(function (resp) {
// https://tools.ietf.org/html/draft-ietf-acme-acme-12#section-7.1.3
// Possible values are: "pending" => ("invalid" || "ready") => "processing" => "valid"
me._nonce = resp.toJSON().headers['replay-nonce'];
@ -1033,7 +1028,7 @@ ACME._finalizeOrder = function(me, options, validatedDomains) {
return pollCert();
};
ACME._getCertificate = function(me, options) {
ACME._getCertificate = function (me, options) {
if (me.debug) {
console.debug('[acme-v2] DEBUG get cert 1');
}
@ -1046,7 +1041,7 @@ ACME._getCertificate = function(me, options) {
options.challengeTypes = [options.challengeType].filter(Boolean);
}
if (options.challengeType) {
options.challengeTypes.sort(function(a, b) {
options.challengeTypes.sort(function (a, b) {
if (a === options.challengeType) {
return -1;
}
@ -1093,36 +1088,32 @@ ACME._getCertificate = function(me, options) {
} else {
//return Promise.reject(new Error("must include KeyID"));
// This is an idempotent request. It'll return the same account for the same public key.
return ACME._registerAccount(me, options).then(function() {
return ACME._registerAccount(me, options).then(function () {
// start back from the top
return ACME._getCertificate(me, options);
});
}
}
var dnsHosts = options.domains.map(function(d) {
return (
require('crypto')
.randomBytes(2)
.toString('hex') + d
);
var dnsHosts = options.domains.map(function (d) {
return require('crypto').randomBytes(2).toString('hex') + d;
});
return ACME._depInit(me, options, dnsHosts).then(function(nada) {
return ACME._depInit(me, options, dnsHosts).then(function (nada) {
if (nada) {
// fake use of nada to make both _wrapCb and jshint happy
}
return ACME._getZones(me, options, dnsHosts).then(function(zonenames) {
return ACME._getZones(me, options, dnsHosts).then(function (zonenames) {
options.zonenames = zonenames;
// Do a little dry-run / self-test
return ACME._testChallenges(me, options).then(function() {
return ACME._testChallenges(me, options).then(function () {
if (me.debug) {
console.debug('[acme-v2] certificates.create');
}
return ACME._getNonce(me).then(function() {
return ACME._getNonce(me).then(function () {
var body = {
// raw wildcard syntax MUST be used here
identifiers: options.domains
.sort(function(a, b) {
.sort(function (a, b) {
// the first in the list will be the subject of the certificate, I believe (and hope)
if (!options.subject) {
return 0;
@ -1135,7 +1126,7 @@ ACME._getCertificate = function(me, options) {
}
return 0;
})
.map(function(hostname) {
.map(function (hostname) {
return { type: 'dns', value: hostname };
})
//, "notBefore": "2016-01-01T00:00:00Z"
@ -1172,7 +1163,7 @@ ACME._getCertificate = function(me, options) {
headers: { 'Content-Type': 'application/jose+json' },
json: jws
})
.then(function(resp) {
.then(function (resp) {
me._nonce = resp.toJSON().headers['replay-nonce'];
var location = resp.toJSON().headers.location;
var setAuths;
@ -1209,41 +1200,41 @@ ACME._getCertificate = function(me, options) {
return;
}
return ACME._getChallenges(me, options, authUrl).then(function(
results
) {
// var domain = options.domains[i]; // results.identifier.value
return ACME._getChallenges(me, options, authUrl).then(
function (results) {
// var domain = options.domains[i]; // results.identifier.value
// If it's already valid, we're golden it regardless
if (
results.challenges.some(function(ch) {
return 'valid' === ch.status;
})
) {
return setNext();
}
// If it's already valid, we're golden it regardless
if (
results.challenges.some(function (ch) {
return 'valid' === ch.status;
})
) {
return setNext();
}
var challenge = ACME._chooseChallenge(options, results);
if (!challenge) {
// For example, wildcards require dns-01 and, if we don't have that, we have to bail
return Promise.reject(
new Error(
"Server didn't offer any challenge we can handle for '" +
options.domains.join() +
"'."
)
var challenge = ACME._chooseChallenge(options, results);
if (!challenge) {
// For example, wildcards require dns-01 and, if we don't have that, we have to bail
return Promise.reject(
new Error(
"Server didn't offer any challenge we can handle for '" +
options.domains.join() +
"'."
)
);
}
var auth = ACME._challengeToAuth(
me,
options,
results,
challenge
);
auths.push(auth);
return ACME._setChallenge(me, options, auth).then(setNext);
}
var auth = ACME._challengeToAuth(
me,
options,
results,
challenge
);
auths.push(auth);
return ACME._setChallenge(me, options, auth).then(setNext);
});
);
}
function challengeNext() {
@ -1261,17 +1252,17 @@ ACME._getCertificate = function(me, options) {
// Doing otherwise would potentially cause us to poison our own DNS cache with misses
return setNext()
.then(challengeNext)
.then(function() {
.then(function () {
if (me.debug) {
console.debug('[getCertificate] next.then');
}
var validatedDomains = body.identifiers.map(function(ident) {
var validatedDomains = body.identifiers.map(function (ident) {
return ident.value;
});
return ACME._finalizeOrder(me, options, validatedDomains);
})
.then(function(order) {
.then(function (order) {
if (me.debug) {
console.debug('acme-v2: order was finalized');
}
@ -1281,7 +1272,7 @@ ACME._getCertificate = function(me, options) {
url: me._certificate,
json: true
})
.then(function(resp) {
.then(function (resp) {
if (me.debug) {
console.debug(
'acme-v2: csr submitted and cert received:'
@ -1322,18 +1313,18 @@ ACME.create = function create(me) {
me.RSA = me.RSA || require('rsa-compat').RSA;
//me.Keypairs = me.Keypairs || require('keypairs');
me.request = me.request || require('@root/request');
me._dig = function(query) {
me._dig = function (query) {
// TODO use digd.js
return new Promise(function(resolve, reject) {
return new Promise(function (resolve, reject) {
var dns = require('dns');
dns.resolveTxt(query.name, function(err, records) {
dns.resolveTxt(query.name, function (err, records) {
if (err) {
reject(err);
return;
}
resolve({
answer: records.map(function(rr) {
answer: records.map(function (rr) {
return {
data: rr
};
@ -1371,7 +1362,7 @@ ACME.create = function create(me) {
me._request = me.promisify(getRequest({}));
}
me.init = function(_directoryUrl) {
me.init = function (_directoryUrl) {
if (_directoryUrl) {
_directoryUrl = _directoryUrl.directoryUrl || _directoryUrl;
}
@ -1393,28 +1384,25 @@ ACME.create = function create(me) {
console.warn('\t' + me.directoryUrl.replace('-staging', ''));
console.warn();
}
return ACME._directory(me).then(function(resp) {
return ACME._directory(me).then(function (resp) {
me._directoryUrls = resp.body;
me._tos = me._directoryUrls.meta.termsOfService;
return me._directoryUrls;
});
};
me.accounts = {
create: function(options) {
create: function (options) {
return ACME._registerAccount(me, options);
}
};
me.certificates = {
create: function(options) {
create: function (options) {
return ACME._getCertificate(me, options);
}
};
return me;
};
ACME._toWebsafeBase64 = function(b64) {
return b64
.replace(/\+/g, '-')
.replace(/\//g, '_')
.replace(/=/g, '');
ACME._toWebsafeBase64 = function (b64) {
return b64.replace(/\+/g, '-').replace(/\//g, '_').replace(/=/g, '');
};