Certificates for other hosts: jarl cert get

jarld obtains and renews a certificate for another host; the host asks
for it with one command, waits, downloads it when it is newer than its
copy and runs a hook with the paths in JARL_CERT_* variables.

- Certificates have an owner user; another user can't take the name.
  An existing one is obtained again only when a name is added or
  removed. A new certificates grant (names=) says which names a user
  may have; it is never part of "*". Users may own
  certificates.max_per_user certificates (10) or their own cert_limit.
- POST /certificates/{name}/request; owners may list, show, export and
  delete theirs; keys only over HTTPS, the socket or loopback; every
  download is recorded and shown as "Pulled by".
- CLI: jarl cert get (saved settings, all saved when no name), cert
  saved, cert forget, cert schedule (daily systemd timer, Linux, root).
- Migration 14. Tests: server, auth, and e2e against Pebble.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/server/h_certs.go

@@ -4,7 +4,11 @@ import (
 	"context"
 	"encoding/pem"
 	"errors"
+	"fmt"
+	"net"
 	"net/http"
+	"net/netip"
+	"strings"
 	"time"
 
 	"jarl/internal/api"
@@ -28,6 +32,10 @@ type certView struct {
 	NamedUse []string `json:"named_use,omitempty"`
 	// IssuingSince is set while Jarl is obtaining it.
 	IssuingSince *time.Time `json:"issuing_since,omitempty"`
+	// Owner is the user a certificate for another host belongs to; PulledBy
+	// who downloaded it (list and get, administrators only).
+	Owner    string                  `json:"owner,omitempty"`
+	PulledBy []model.CertificatePull `json:"pulled_by,omitempty"`
 }
 
 type certFiles struct {
@@ -62,6 +70,78 @@ func (s *Server) certsReady(p *auth.Principal) error {
 	return nil
 }
 
+// certsAccess lets in administrators and users with a certificates grant
+// (certificates for other hosts: their own only).
+func (s *Server) certsAccess(p *auth.Principal) error {
+	if s.cfg.Certs == nil {
+		return &httpError{http.StatusNotFound, "disabled", "certificates aren't available in this jarld"}
+	}
+	if p.IsAdmin() || p.Can(auth.Action{Resource: auth.ResCerts}) {
+		return nil
+	}
+	return forbidden("certificates need an administrator, or a certificates grant for their names (certificates:write names=*.example.com)")
+}
+
+// certAllowed reports whether p may see (or, with write, change) c: an
+// administrator any; anyone else their own, while their grants cover all
+// its names.
+func certAllowed(p *auth.Principal, c *model.Certificate, write bool) bool {
+	if p.IsAdmin() {
+		return true
+	}
+	if p.User == nil || c.OwnerID == 0 || c.OwnerID != p.User.ID {
+		return false
+	}
+	for _, d := range c.Domains {
+		if !p.Can(auth.Action{Resource: auth.ResCerts, Write: write, Name: d}) {
+			return false
+		}
+	}
+	return true
+}
+
+// certFor returns the certificate in the path, if p may see it (else not
+// found, so names of others' certificates don't leak).
+func (s *Server) certFor(r *http.Request, p *auth.Principal, write bool) (*model.Certificate, error) {
+	c, err := s.cfg.Certs.Get(r.Context(), r.PathValue("name"))
+	if err != nil {
+		return nil, certErr(err)
+	}
+	if !certAllowed(p, c, write) {
+		if write && certAllowed(p, c, false) {
+			return nil, forbidden("you may only download certificate %s", c.Name)
+		}
+		return nil, notFound("no such certificate")
+	}
+	return c, nil
+}
+
+// withOwners adds owners and downloads to views (for administrators).
+func (s *Server) withOwners(ctx context.Context, views []certView) error {
+	pulls, err := s.store.CertificatePulls(ctx)
+	if err != nil {
+		return err
+	}
+	users, err := s.store.ListUsers(ctx)
+	if err != nil {
+		return err
+	}
+	names := map[int64]string{}
+	for _, u := range users {
+		names[u.ID] = u.Username
+	}
+	for i := range views {
+		if id := views[i].OwnerID; id != 0 {
+			views[i].Owner = names[id]
+			if views[i].Owner == "" {
+				views[i].Owner = fmt.Sprintf("deleted user %d", id)
+			}
+		}
+		views[i].PulledBy = pulls[views[i].ID]
+	}
+	return nil
+}
+
 func certErr(err error) error {
 	var ie *certs.InputError
 	switch {
@@ -71,13 +151,15 @@ func certErr(err error) error {
 		return notFound("no such certificate")
 	case errors.Is(err, certs.ErrConflict):
 		return conflict("a certificate with that name exists")
+	case errors.Is(err, certs.ErrTaken):
+		return conflict("the certificate name is taken by another user's certificate (or one Jarl uses): choose another name")
 	}
 	return err
 }
 
 // certList: GET /certificates.
 func (s *Server) certList(w http.ResponseWriter, r *http.Request, p *auth.Principal) error {
-	if err := s.certsReady(p); err != nil {
+	if err := s.certsAccess(p); err != nil {
 		return err
 	}
 	all, err := s.cfg.Certs.List(r.Context())
@@ -90,22 +172,32 @@ func (s *Server) certList(w http.ResponseWriter, r *http.Request, p *auth.Princi
 	}
 	out := []certView{}
 	for _, c := range all {
+		if !certAllowed(p, c, false) {
+			continue
+		}
 		v := s.presentCert(c)
 		v.NamedUse = encdns.CertUses(st, s.cfg.Certs.FilesDir(c.Name))
 		out = append(out, v)
 	}
+	if !p.IsAdmin() {
+		writeJSON(w, http.StatusOK, map[string]any{"certificates": out})
+		return nil
+	}
+	if err := s.withOwners(r.Context(), out); err != nil {
+		return err
+	}
 	writeJSON(w, http.StatusOK, map[string]any{"certificates": out, "account": s.cfg.Certs.AccountInfo(r.Context())})
 	return nil
 }
 
 // certGet: GET /certificates/{name}.
 func (s *Server) certGet(w http.ResponseWriter, r *http.Request, p *auth.Principal) error {
-	if err := s.certsReady(p); err != nil {
+	if err := s.certsAccess(p); err != nil {
 		return err
 	}
-	c, err := s.cfg.Certs.Get(r.Context(), r.PathValue("name"))
+	c, err := s.certFor(r, p, false)
 	if err != nil {
-		return certErr(err)
+		return err
 	}
 	st, err := s.store.LoadState(r.Context())
 	if err != nil {
@@ -113,22 +205,80 @@ func (s *Server) certGet(w http.ResponseWriter, r *http.Request, p *auth.Princip
 	}
 	v := s.presentCert(c)
 	v.NamedUse = encdns.CertUses(st, s.cfg.Certs.FilesDir(c.Name))
+	if p.IsAdmin() {
+		vs := []certView{v}
+		if err := s.withOwners(r.Context(), vs); err != nil {
+			return err
+		}
+		v = vs[0]
+	}
 	writeJSON(w, http.StatusOK, v)
 	return nil
 }
 
+// certRequest: POST /certificates/{name}/request {"domains": [...],
+// "key_type": "ec256"}, for jarl cert get: the certificate for another
+// host, owned by the caller's user. A new one is created and obtained
+// (202 while that runs; poll GET /certificates/{name} until
+// issuing_since is gone). An existing one is the caller's, obtained again
+// only when its names change; otherwise it is returned as it is (200).
+func (s *Server) certRequest(w http.ResponseWriter, r *http.Request, p *auth.Principal) error {
+	if err := s.certsAccess(p); err != nil {
+		return err
+	}
+	if p.User == nil || p.User.ID == 0 {
+		return forbidden("certificates for other hosts belong to a user: use an API token, not the local socket as root")
+	}
+	var in struct {
+		Domains []string `json:"domains"`
+		KeyType string   `json:"key_type"`
+	}
+	if err := decodeJSON(r, &in); err != nil {
+		return err
+	}
+	for _, d := range in.Domains {
+		d = strings.ToLower(strings.TrimSuffix(strings.TrimSpace(d), "."))
+		if !p.Can(auth.Action{Resource: auth.ResCerts, Write: true, Name: d}) {
+			return forbidden("you may not get a certificate for %s: that needs certificates:write with a names pattern that matches it", d)
+		}
+	}
+	res, err := s.cfg.Certs.Ensure(r.Context(), r.PathValue("name"), in.Domains, in.KeyType, p)
+	if err != nil {
+		return certErr(err)
+	}
+	v := s.presentCert(res.Certificate)
+	out := map[string]any{"certificate": v, "created": res.Created, "changed": res.Changed}
+	if res.Ignored != "" {
+		out["warnings"] = []string{res.Ignored}
+	}
+	status := http.StatusOK
+	if v.IssuingSince != nil {
+		status = http.StatusAccepted
+	}
+	writeJSON(w, status, out)
+	return nil
+}
+
 // certPEM: GET /certificates/{name}/pem?part=fullchain|cert|key|bundle,
 // the certificate as PEM for use elsewhere: the chain (default), the
 // certificate alone, the private key, or the key followed by the chain
 // (one file, as HAProxy wants). Anything with the key is audited.
 func (s *Server) certPEM(w http.ResponseWriter, r *http.Request, p *auth.Principal) error {
-	if err := s.certsReady(p); err != nil {
+	if err := s.certsAccess(p); err != nil {
+		return err
+	}
+	if _, err := s.certFor(r, p, false); err != nil {
 		return err
 	}
 	part := r.URL.Query().Get("part")
 	if part == "" {
 		part = "fullchain"
 	}
+	if part == "key" || part == "bundle" {
+		if ok, why := s.keyTransport(r); !ok {
+			return &httpError{http.StatusForbidden, "https_required", "a private key is only handed out over HTTPS (or to this server itself), and this request came by " + why}
+		}
+	}
 	c, chain, key, err := s.cfg.Certs.PEM(r.Context(), r.PathValue("name"))
 	if err != nil {
 		return certErr(err)
@@ -155,6 +305,16 @@ func (s *Server) certPEM(w http.ResponseWriter, r *http.Request, p *auth.Princip
 	if part == "key" || part == "bundle" {
 		s.eng.Audit(r.Context(), p, "certificate.export_key", "certificate", c.ID, c.Name, "success", "exported the private key ("+part+")")
 	}
+	pull := &model.CertificatePull{CertID: c.ID, Who: pullWho(p), Serial: c.Serial, IP: s.clientIP(r), At: time.Now().UTC()}
+	if p.User != nil {
+		pull.UserID = p.User.ID
+	}
+	if p.Token != nil {
+		pull.TokenID = p.Token.ID
+	}
+	if err := s.store.RecordCertificatePull(r.Context(), pull); err != nil {
+		s.log.Warn("recording a certificate download failed", "certificate", c.Name, "err", err)
+	}
 	w.Header().Set("Content-Type", "application/x-pem-file")
 	w.Header().Set("Content-Disposition", `attachment; filename="`+file+`"`)
 	w.Header().Set("Cache-Control", "no-store")
@@ -208,7 +368,10 @@ func (s *Server) certUpdate(w http.ResponseWriter, r *http.Request, p *auth.Prin
 
 // certDelete: DELETE /certificates/{name}.
 func (s *Server) certDelete(w http.ResponseWriter, r *http.Request, p *auth.Principal) error {
-	if err := s.certsReady(p); err != nil {
+	if err := s.certsAccess(p); err != nil {
+		return err
+	}
+	if _, err := s.certFor(r, p, true); err != nil {
 		return err
 	}
 	if err := s.cfg.Certs.Delete(r.Context(), r.PathValue("name"), p); err != nil {
@@ -303,3 +466,28 @@ func (s *Server) certSummary(ctx context.Context) *api.CertSummary {
 	}
 	return out
 }
+
+// keyTransport reports whether a private key may go back over r: HTTPS
+// (also through a trusted proxy), the local socket, or loopback.
+func (s *Server) keyTransport(r *http.Request) (bool, string) {
+	https, why := s.transport(r)
+	if https {
+		return true, why
+	}
+	host, _, _ := net.SplitHostPort(r.RemoteAddr)
+	if a, err := netip.ParseAddr(host); err == nil && a.Unmap().IsLoopback() && !s.trusted(a.Unmap()) {
+		return true, "plain HTTP from this server"
+	}
+	return false, why
+}
+
+// pullWho names a downloader: its token (and user), or the user.
+func pullWho(p *auth.Principal) string {
+	switch {
+	case p.Token != nil:
+		return "token " + p.Token.Name + " (" + p.Name() + ")"
+	case p.User != nil && p.Method != "":
+		return p.Method + " " + p.Name()
+	}
+	return p.Name()
+}