aswi2021jmsd-gitlab/src/controllers/certificates_controller.py @ 5f8a2c07

import json
from datetime import datetime
from itertools import chain
from json import JSONDecodeError

from flask import request
from injector import inject

from src.constants import CA_ID, \
    SSL_ID, SIGNATURE_ID, AUTHENTICATION_ID, \
    DATETIME_FORMAT, ROOT_CA_ID, INTERMEDIATE_CA_ID, CERTIFICATE_ID  # TODO DATABASE_FILE - not the Controller's
from src.exceptions.database_exception import DatabaseException
from src.exceptions.unknown_exception import UnknownException
from src.model.subject import Subject
from src.services.certificate_service import CertificateService, RevocationReasonInvalidException, \
    CertificateStatusInvalidException, CertificateNotFoundException, CertificateAlreadyRevokedException
#  responsibility.
from src.services.key_service import KeyService

TREE_NODE_TYPE_COUNT = 3

FILTERING = "filtering"
ISSUER = "issuer"
US = "usage"
NOT_AFTER = "notAfter"
NOT_BEFORE = "notBefore"
COMMON_NAME = "CN"
ID = "id"
USAGE = "usage"
SUBJECT = "subject"
VALIDITY_DAYS = "validityDays"
CA = "CA"
STATUS = "status"
REASON = "reason"
REASON_UNDEFINED = "unspecified"

E_NO_ISSUER_FOUND = {"success": False, "data": "No certificate authority with such unique ID exists."}
E_NO_CERTIFICATES_FOUND = {"success": False, "data": "No such certificate found."}
E_NO_CERTIFICATE_ALREADY_REVOKED = {"success": False, "data": "Certificate is already revoked."}
E_NO_CERT_PRIVATE_KEY_FOUND = {"success": False,
                               "data": "Internal server error (certificate's private key cannot be found)."}
E_NOT_JSON_FORMAT = {"success": False, "data": "The request must be JSON-formatted."}
E_CORRUPTED_DATABASE = {"success": False, "data": "Internal server error (corrupted database)."}
E_GENERAL_ERROR = {"success": False, "data": "Internal server error (unknown origin)."}
E_MISSING_PARAMETERS = {"success": False, "data": "Invalid request, missing parameters."}
E_WRONG_PARAMETERS = {"success": False, "data": "Invalid request, wrong parameters."}

C_CREATED_SUCCESSFULLY = 201
C_BAD_REQUEST = 400
C_NOT_FOUND = 404
C_NO_DATA = 205  # TODO related to 204 issue                                               # TODO related to 204 issue
C_INTERNAL_SERVER_ERROR = 500
C_SUCCESS = 200


class CertController:
    KEY_MAP = {'CA': CA_ID, 'SSL': SSL_ID, 'digitalSignature': SIGNATURE_ID, 'authentication': AUTHENTICATION_ID}
    INVERSE_KEY_MAP = {k: v for v, k in KEY_MAP.items()}

    @inject
    def __init__(self, certificate_service: CertificateService, key_service: KeyService):
        self.certificate_service = certificate_service
        self.key_service = key_service

    def create_certificate(self):
        """create new certificate

        Create a new certificate based on given information

        :param body: Certificate data to be created
        :type body: dict | bytes

        :rtype: CreatedResponse
        """
        required_keys = {SUBJECT, USAGE, VALIDITY_DAYS}                             # required fields of the POST req

        if request.is_json:                                                         # accept JSON only
            body = request.get_json()
            if not all(k in body for k in required_keys):                           # verify that all keys are present
                return E_MISSING_PARAMETERS, C_BAD_REQUEST

            if not isinstance(body[VALIDITY_DAYS], int):                            # type checking
                return E_WRONG_PARAMETERS, C_BAD_REQUEST

            subject = Subject.from_dict(body[SUBJECT])                              # generate Subject from passed dict

            if subject is None:                                                     # if the format is incorrect
                return E_WRONG_PARAMETERS, C_BAD_REQUEST

            usages_dict = {}

            if not isinstance(body[USAGE], dict):                                   # type checking
                return E_WRONG_PARAMETERS, C_BAD_REQUEST

            for k, v in body[USAGE].items():                                        # for each usage
                if k not in CertController.KEY_MAP:                                 # check that it is a valid usage
                    return E_WRONG_PARAMETERS, C_BAD_REQUEST                        # and throw if it is not
                usages_dict[CertController.KEY_MAP[k]] = v                          # otherwise translate key and set

            key = self.key_service.create_new_key()                                      # TODO pass key

            if CA not in body or body[CA] is None:                                  # if issuer omitted (legal) or none
                cert = self.certificate_service.create_root_ca(                          # create a root CA
                    key,
                    subject,
                    usages=usages_dict,                                             # TODO ignoring usages -> discussion
                    days=body[VALIDITY_DAYS]
                )
            else:
                issuer = self.certificate_service.get_certificate(body[CA])              # get base issuer info

                if issuer is None:                                                  # if such issuer does not exist
                    self.key_service.delete_key(key.private_key_id)                      # free
                    return E_NO_ISSUER_FOUND, C_BAD_REQUEST                         # and throw

                issuer_key = self.key_service.get_key(issuer.private_key_id)             # get issuer's key, which must exist

                if issuer_key is None:                                              # if it does not
                    self.key_service.delete_key(key.private_key_id)                      # free
                    return E_CORRUPTED_DATABASE, C_INTERNAL_SERVER_ERROR            # and throw

                f = self.certificate_service.create_ca if CA_ID in usages_dict and usages_dict[CA_ID] else \
                    self.certificate_service.create_end_cert

                # noinspection PyTypeChecker
                cert = f(                                                           # create inter CA or end cert
                    key,                                                            # according to whether 'CA' is among
                    subject,                                                        # the usages' fields
                    issuer,
                    issuer_key,
                    usages=usages_dict,
                    days=body[VALIDITY_DAYS]
                )

            if cert is not None:
                return {"success": True,
                        "data": cert.certificate_id}, C_CREATED_SUCCESSFULLY
            else:                                                                   # if this fails, then
                self.key_service.delete_key(key.private_key_id)                          # free
                return {"success": False,                                           # and wonder what the cause is,
                        "data": "Internal error: The certificate could not have been created."}, C_BAD_REQUEST
                                                                                    # as obj/None carries only one bit
                                                                                    # of error information
        else:
            return E_NOT_JSON_FORMAT, C_BAD_REQUEST                                 # throw in case of non-JSON format

    def get_certificate_by_id(self, id):
        """get certificate by ID

        Get certificate in PEM format by ID

        :param id: ID of a certificate to be queried
        :type id: dict | bytes

        :rtype: PemResponse
        """
        try:
            v = int(id)
        except ValueError:
            return E_WRONG_PARAMETERS, C_BAD_REQUEST

        cert = self.certificate_service.get_certificate(v)

        if cert is None:
            return E_NO_CERTIFICATES_FOUND, C_NO_DATA
        else:
            return {"success": True, "data": cert.pem_data}, C_SUCCESS

    def get_certificate_details_by_id(self, id):
        """get certificate's details by ID

        Get certificate details by ID

        :param id: ID of a certificate whose details are to be queried
        :type id: dict | bytes

        :rtype: CertificateResponse
        """
        try:
            v = int(id)
        except ValueError:
            return E_WRONG_PARAMETERS, C_BAD_REQUEST

        cert = self.certificate_service.get_certificate(v)

        if cert is None:
            return E_NO_CERTIFICATES_FOUND, C_NO_DATA
        else:
            data = self.cert_to_dict_full(cert)
            if data is None:
                return E_CORRUPTED_DATABASE, C_INTERNAL_SERVER_ERROR
            return {"success": True, "data": data}, C_SUCCESS

    def get_certificate_list(self):
        """get list of certificates

        Lists certificates based on provided filtering options

        :param filtering: Filter certificate type to be queried
        :type filtering: dict | bytes

        :rtype: CertificateListResponse
        """
        targets = {ROOT_CA_ID, INTERMEDIATE_CA_ID, CERTIFICATE_ID}                  # all targets

        # the filtering parameter can be read as URL argument or as a request body
        if request.is_json or "filtering" in request.args.keys():                   # if the request carries JSON data
            if request.is_json:
                data = request.get_json()                                           # get it
            else:
                try:
                    data = {"filtering": json.loads(request.args["filtering"])}
                except JSONDecodeError:
                    return E_NOT_JSON_FORMAT, C_BAD_REQUEST

            if FILTERING in data:                                                   # if the 'filtering' field exists
                if isinstance(data[FILTERING], dict):                               # and it is also a 'dict'
                    if CA in data[FILTERING]:                                       # containing 'CA'
                        if isinstance(data[FILTERING][CA], bool):                   # which is a 'bool',
                            if data[FILTERING][CA]:                                 # then filter according to 'CA'.
                                targets.remove(CERTIFICATE_ID)
                            else:
                                targets.remove(ROOT_CA_ID)
                                targets.remove(INTERMEDIATE_CA_ID)
                        else:
                            return E_WRONG_PARAMETERS, C_BAD_REQUEST
                else:
                    return E_WRONG_PARAMETERS, C_BAD_REQUEST

        if len(targets) == TREE_NODE_TYPE_COUNT:                                    # = 3 -> root node,
                                                                                    # intermediate node,
                                                                                    # or leaf node

                                                                                    # if filtering did not change the
                                                                                    # targets,
            certs = self.certificate_service.get_certificates()                          # fetch everything
        else:                                                                       # otherwise fetch targets only
            certs = list(chain(*(self.certificate_service.get_certificates(target) for target in targets)))

        if certs is None:
            return E_GENERAL_ERROR, C_INTERNAL_SERVER_ERROR
        elif len(certs) == 0:
            return E_NO_CERTIFICATES_FOUND, C_NO_DATA
        else:
            ret = []
            for c in certs:
                data = self.cert_to_dict_partial(c)
                if data is None:
                    return E_CORRUPTED_DATABASE, C_INTERNAL_SERVER_ERROR
                ret.append(
                    data
                )
            return {"success": True, "data": ret}, C_SUCCESS

    def get_certificate_root_by_id(self, id):
        """get certificate's root of trust chain by ID

        Get certificate's root of trust chain in PEM format by ID

        :param id: ID of a child certificate whose root is to be queried
        :type id: dict | bytes

        :rtype: PemResponse
        """
        try:
            v = int(id)
        except ValueError:
            return E_WRONG_PARAMETERS, C_BAD_REQUEST

        cert = self.certificate_service.get_certificate(v)

        if cert is None:
            return E_NO_CERTIFICATES_FOUND, C_NO_DATA

        trust_chain = self.certificate_service.get_chain_of_trust(cert.parent_id, exclude_root=False)
        if trust_chain is None or len(trust_chain) == 0:
            return E_NO_CERTIFICATES_FOUND, C_NO_DATA

        return {"success": True, "data": trust_chain[-1].pem_data}, C_SUCCESS

    def get_certificate_trust_chain_by_id(self, id):
        """get certificate's trust chain by ID

        Get certificate trust chain in PEM format by ID

        :param id: ID of a child certificate whose chain is to be queried
        :type id: dict | bytes

        :rtype: PemResponse
        """

        try:
            v = int(id)
        except ValueError:
            return E_WRONG_PARAMETERS, C_BAD_REQUEST

        cert = self.certificate_service.get_certificate(v)

        if cert is None:
            return E_NO_CERTIFICATES_FOUND, C_NO_DATA

        if cert.parent_id is None:
            return E_NO_CERTIFICATES_FOUND, C_NO_DATA

        trust_chain = self.certificate_service.get_chain_of_trust(cert.parent_id)

        ret = []
        for intermediate in trust_chain:
            ret.append(intermediate.pem_data)

        return {"success": True, "data": "".join(ret)}, C_SUCCESS

    def set_certificate_status(self, id):
        """
        Revoke a certificate given by ID
            - revocation request may contain revocation reason
            - revocation reason is verified based on the possible predefined values
            - if revocation reason is not specified 'undefined' value is used
        :param id: Identifier of the certificate to be revoked
        :type id: int

        :rtype: SuccessResponse | ErrorResponse (see OpenAPI definition)
        """
        required_keys = {STATUS}  # required keys

        # try to parse certificate identifier -> if it is not int return error 400
        try:
            identifier = int(id)
        except ValueError:
            return E_WRONG_PARAMETERS, C_BAD_REQUEST

        # check if the request contains a JSON body
        if request.is_json:
            request_body = request.get_json()
            # verify that all required keys are present
            if not all(k in request_body for k in required_keys):
                return E_MISSING_PARAMETERS, C_BAD_REQUEST

            # get status and reason from the request
            status = request_body[STATUS]
            reason = request_body.get(REASON, REASON_UNDEFINED)
            try:
                # set certificate status using certificate_service
                self.certificate_service.set_certificate_revocation_status(identifier, status, reason)
            except (RevocationReasonInvalidException, CertificateStatusInvalidException):
                # these exceptions are thrown in case invalid status or revocation reason is passed to the controller
                return E_WRONG_PARAMETERS, C_BAD_REQUEST
            except CertificateAlreadyRevokedException:
                return E_NO_CERTIFICATE_ALREADY_REVOKED, C_BAD_REQUEST
            except CertificateNotFoundException:
                return E_NO_CERTIFICATES_FOUND, C_NOT_FOUND
            return {"success": True,
                    "data": "Certificate status updated successfully."}, C_SUCCESS
        # throw an error in case the request does not contain a json body
        else:
            return E_NOT_JSON_FORMAT, C_BAD_REQUEST

    def cert_to_dict_partial(self, c):
        """
        Dictionarizes a certificate directly fetched from the database. Contains partial information.
        :param c: target cert
        :return: certificate dict (compliant with some parts of the REST API)
        """
        c_issuer = self.certificate_service.get_certificate(c.parent_id)
        if c_issuer is None:
            return None

        return {
            ID: c.certificate_id,
            COMMON_NAME: c.common_name,
            NOT_BEFORE: datetime.strptime(c.valid_from, DATETIME_FORMAT).date(),
            NOT_AFTER: datetime.strptime(c.valid_to, DATETIME_FORMAT).date(),
            USAGE: {CertController.INVERSE_KEY_MAP[k]: v for k, v in c.usages.items()},
            ISSUER: {
                ID: c_issuer.certificate_id,
                COMMON_NAME: c_issuer.common_name
            }
        }

    def cert_to_dict_full(self, c):
        """
        Dictionarizes a certificate directly fetched from the database, but adds subject info.
        Contains full information.
        :param c: target cert
        :return: certificate dict (compliant with some parts of the REST API)
        """
        subj = self.certificate_service.get_subject_from_certificate(c)
        c_issuer = self.certificate_service.get_certificate(c.parent_id)
        if c_issuer is None:
            return None

        return {
            SUBJECT: subj.to_dict(),
            NOT_BEFORE: datetime.strptime(c.valid_from, DATETIME_FORMAT).date(),
            NOT_AFTER: datetime.strptime(c.valid_to, DATETIME_FORMAT).date(),
            USAGE: {CertController.INVERSE_KEY_MAP[k]: v for k, v in c.usages.items()},
            CA: c_issuer.certificate_id
        }

    def get_private_key_of_a_certificate(self, id):
        """
        Get a private key used to sign a certificate in PEM format specified by certificate's ID

        :param id: ID of a certificate whose private key is to be queried
        :type id: dict | bytes

        :rtype: PemResponse
        """

        # try to parse the supplied ID
        try:
            v = int(id)
        except ValueError:
            return E_WRONG_PARAMETERS, C_BAD_REQUEST

        # find a certificate using the given ID
        cert = self.certificate_service.get_certificate(v)

        if cert is None:
            return E_NO_CERTIFICATES_FOUND, C_NOT_FOUND
        else:
            # certificate exists, fetch it's private key
            private_key = self.key_service.get_key(cert.private_key_id)
            if cert is None:
                return E_NO_CERT_PRIVATE_KEY_FOUND, C_INTERNAL_SERVER_ERROR
            else:
                return {"success": True, "data": private_key.private_key}, C_SUCCESS

    def get_public_key_of_a_certificate(self, id):
        """
        Get a public key of a certificate in PEM format specified by certificate's ID

        :param id: ID of a certificate whose public key is to be queried
        :type id: dict | bytes

        :rtype: PemResponse
        """

        # try to parse the supplied ID
        try:
            v = int(id)
        except ValueError:
            return E_WRONG_PARAMETERS, C_BAD_REQUEST

        # find a certificate using the given ID
        cert = self.certificate_service.get_certificate(v)

        if cert is None:
            return E_NO_CERTIFICATES_FOUND, C_NOT_FOUND
        else:
            return {"success": True, "data": self.certificate_service.get_public_key_from_certificate(cert)}, C_SUCCESS

    def delete_certificate(self, id):
        """
        Deletes a certificate identified by ID, including its corresponding subtree (all descendants).
        :param id: target certificate ID
        :rtype: DeleteResponse
        """
        try:
            v = int(id)
        except ValueError:
            return E_WRONG_PARAMETERS, C_BAD_REQUEST

        try:
            self.certificate_service.delete_certificate(v)
        except CertificateNotFoundException:
            return E_NO_CERTIFICATES_FOUND, C_NOT_FOUND
        except DatabaseException:
            return E_CORRUPTED_DATABASE, C_INTERNAL_SERVER_ERROR
        except CertificateStatusInvalidException or RevocationReasonInvalidException or UnknownException:
            return E_GENERAL_ERROR, C_INTERNAL_SERVER_ERROR

        return {"success": True, "data": "The certificate and its descendants have been successfully deleted."}