feat: add create-only root certificate API (#7033)
* feat: add create-only root certificate API [skip ci] * fix: harden root certificate API handling
This commit is contained in:
Thomas authored and 
GitHub committed
1 parent
67cff1fbc0
commit
a17845aa1c
8 files changed
+542
-2
No files matched your search
@@ -54,6 +54,20 @@ on every layout, and caps width to the available columns.
|
||||
`board.updateItemLayout` (`PATCH /api/boards/{boardId}/items/{itemId}/layouts/{layoutId}`) moves or resizes one item in
|
||||
one layout without replacing the board. It cannot move the item outside its section or overlap another item/container.
|
||||
|
||||
## Root CA automation
|
||||
|
||||
Administrators can inspect a named CA with `GET /api/certificates/{fileName}` (`certificates.getCertificate`) or
|
||||
create it with `POST /api/certificates/root` (`certificates.ensureRootCertificate`), using JSON `{ fileName, certificate }`.
|
||||
Names are limited to 128 characters, start with a letter or digit, contain only letters, digits, dots, underscores and
|
||||
hyphens, and end in `.crt` or `.pem`. Supply one currently valid self-signed PEM root CA, at most 64 KiB, without a chain
|
||||
or private key.
|
||||
|
||||
Inspection returns public metadata or `null` when absent. Creation returns `{ created, certificate }`; identical PEM
|
||||
bytes return `created: false`, while different existing bytes or unsafe file paths return `CONFLICT` without replacement.
|
||||
`sha256` hashes the exact UTF-8 PEM bytes, including whitespace; `fingerprint256` identifies the DER certificate.
|
||||
Dates are ISO 8601. Certificate contents are never returned. Expired stored roots remain inspectable. Trust applies to
|
||||
subsequent integration requests without a restart; it does not bypass hostname verification.
|
||||
|
||||
## Docker targets
|
||||
|
||||
Docker actions require `{ endpointId, id }` targets from `docker.getContainers`; `endpointId` distinguishes hosts.
|
||||
|
||||
@@ -5545,6 +5545,273 @@
|
||||
}
|
||||
}
|
||||
},
|
||||
"/api/certificates/{fileName}": {
|
||||
"get": {
|
||||
"operationId": "certificates-getCertificate",
|
||||
"summary": "Inspect a named custom root CA certificate",
|
||||
"description": "Return public metadata or null when absent. Requires admin permission. Does not return PEM contents.",
|
||||
"tags": [
|
||||
"certificates"
|
||||
],
|
||||
"security": [
|
||||
{
|
||||
"apikey": []
|
||||
}
|
||||
],
|
||||
"parameters": [
|
||||
{
|
||||
"in": "path",
|
||||
"name": "fileName",
|
||||
"schema": {
|
||||
"type": "string",
|
||||
"maxLength": 128,
|
||||
"pattern": "^[a-zA-Z0-9][a-zA-Z0-9._-]*\\.(crt|pem)$"
|
||||
},
|
||||
"required": true
|
||||
}
|
||||
],
|
||||
"responses": {
|
||||
"200": {
|
||||
"description": "Successful response",
|
||||
"content": {
|
||||
"application/json": {
|
||||
"schema": {
|
||||
"anyOf": [
|
||||
{
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"fileName": {
|
||||
"type": "string",
|
||||
"maxLength": 128,
|
||||
"pattern": "^[a-zA-Z0-9][a-zA-Z0-9._-]*\\.(crt|pem)$"
|
||||
},
|
||||
"sha256": {
|
||||
"type": "string"
|
||||
},
|
||||
"fingerprint256": {
|
||||
"type": "string"
|
||||
},
|
||||
"ca": {
|
||||
"type": "boolean",
|
||||
"const": true
|
||||
},
|
||||
"validFrom": {
|
||||
"type": "string"
|
||||
},
|
||||
"validTo": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"fileName",
|
||||
"sha256",
|
||||
"fingerprint256",
|
||||
"ca",
|
||||
"validFrom",
|
||||
"validTo"
|
||||
],
|
||||
"additionalProperties": false
|
||||
},
|
||||
{
|
||||
"type": "null"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"400": {
|
||||
"description": "Invalid input data",
|
||||
"content": {
|
||||
"application/json": {
|
||||
"schema": {
|
||||
"$ref": "#/components/schemas/error.BAD_REQUEST"
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"401": {
|
||||
"description": "Authorization not provided",
|
||||
"content": {
|
||||
"application/json": {
|
||||
"schema": {
|
||||
"$ref": "#/components/schemas/error.UNAUTHORIZED"
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"403": {
|
||||
"description": "Insufficient access",
|
||||
"content": {
|
||||
"application/json": {
|
||||
"schema": {
|
||||
"$ref": "#/components/schemas/error.FORBIDDEN"
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"404": {
|
||||
"description": "Not found",
|
||||
"content": {
|
||||
"application/json": {
|
||||
"schema": {
|
||||
"$ref": "#/components/schemas/error.NOT_FOUND"
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"500": {
|
||||
"description": "Internal server error",
|
||||
"content": {
|
||||
"application/json": {
|
||||
"schema": {
|
||||
"$ref": "#/components/schemas/error.INTERNAL_SERVER_ERROR"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"/api/certificates/root": {
|
||||
"post": {
|
||||
"operationId": "certificates-ensureRootCertificate",
|
||||
"summary": "Ensure a named custom root CA certificate without overwriting",
|
||||
"description": "Accept one currently valid self-signed PEM root CA (64 KiB maximum). Identical bytes are idempotent; different existing bytes return CONFLICT. Requires admin permission.",
|
||||
"tags": [
|
||||
"certificates"
|
||||
],
|
||||
"security": [
|
||||
{
|
||||
"apikey": []
|
||||
}
|
||||
],
|
||||
"parameters": [],
|
||||
"requestBody": {
|
||||
"required": true,
|
||||
"content": {
|
||||
"application/json": {
|
||||
"schema": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"fileName": {
|
||||
"type": "string",
|
||||
"maxLength": 128,
|
||||
"pattern": "^[a-zA-Z0-9][a-zA-Z0-9._-]*\\.(crt|pem)$"
|
||||
},
|
||||
"certificate": {
|
||||
"type": "string",
|
||||
"minLength": 1,
|
||||
"maxLength": 65536
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"fileName",
|
||||
"certificate"
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"responses": {
|
||||
"200": {
|
||||
"description": "Successful response",
|
||||
"content": {
|
||||
"application/json": {
|
||||
"schema": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"created": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"certificate": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"fileName": {
|
||||
"type": "string",
|
||||
"maxLength": 128,
|
||||
"pattern": "^[a-zA-Z0-9][a-zA-Z0-9._-]*\\.(crt|pem)$"
|
||||
},
|
||||
"sha256": {
|
||||
"type": "string"
|
||||
},
|
||||
"fingerprint256": {
|
||||
"type": "string"
|
||||
},
|
||||
"ca": {
|
||||
"type": "boolean",
|
||||
"const": true
|
||||
},
|
||||
"validFrom": {
|
||||
"type": "string"
|
||||
},
|
||||
"validTo": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"fileName",
|
||||
"sha256",
|
||||
"fingerprint256",
|
||||
"ca",
|
||||
"validFrom",
|
||||
"validTo"
|
||||
],
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"created",
|
||||
"certificate"
|
||||
],
|
||||
"additionalProperties": false
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"400": {
|
||||
"description": "Invalid input data",
|
||||
"content": {
|
||||
"application/json": {
|
||||
"schema": {
|
||||
"$ref": "#/components/schemas/error.BAD_REQUEST"
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"401": {
|
||||
"description": "Authorization not provided",
|
||||
"content": {
|
||||
"application/json": {
|
||||
"schema": {
|
||||
"$ref": "#/components/schemas/error.UNAUTHORIZED"
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"403": {
|
||||
"description": "Insufficient access",
|
||||
"content": {
|
||||
"application/json": {
|
||||
"schema": {
|
||||
"$ref": "#/components/schemas/error.FORBIDDEN"
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"500": {
|
||||
"description": "Internal server error",
|
||||
"content": {
|
||||
"application/json": {
|
||||
"schema": {
|
||||
"$ref": "#/components/schemas/error.INTERNAL_SERVER_ERROR"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"/api/integrations/request": {
|
||||
"post": {
|
||||
"operationId": "integration-request",
|
||||
|
||||
Reference in new issue
Block a user