cert.go

package ngrokd

import (
	"context"
	"crypto/ecdsa"
	"crypto/elliptic"
	"crypto/rand"
	"crypto/tls"
	"crypto/x509"
	"crypto/x509/pkix"
	"encoding/pem"
	"fmt"
)

type certProvisioner struct {
	store             CertStore
	apiClient         *apiClient
	endpointSelectors []string
}

func newCertProvisioner(store CertStore, apiClient *apiClient, endpointSelectors []string) *certProvisioner {
	return &certProvisioner{
		store:             store,
		apiClient:         apiClient,
		endpointSelectors: endpointSelectors,
	}
}

func (p *certProvisioner) EnsureCertificate(ctx context.Context) (cert tls.Certificate, operatorID string, err error) {
	// Check if certificate exists in store
	exists, err := p.store.Exists(ctx)
	if err != nil {
		return tls.Certificate{}, "", fmt.Errorf("failed to check store: %w", err)
	}

	if exists {
		keyPEM, certPEM, opID, err := p.store.Load(ctx)
		if err == nil {
			cert, err = tls.X509KeyPair(certPEM, keyPEM)
			if err == nil {
				return cert, opID, nil
			}
		}
		// Fall through to provision if load failed
	}

	// Provision new certificate
	return p.provisionCertificate(ctx)
}

func (p *certProvisioner) provisionCertificate(ctx context.Context) (tls.Certificate, string, error) {
	// Validate store is writable before creating operator to prevent
	// orphaned operators on permission errors during crash loops
	if err := p.store.CanWrite(ctx); err != nil {
		return tls.Certificate{}, "", fmt.Errorf("certificate store not writable: %w", err)
	}

	// Generate ECDSA P-384 private key
	privateKey, err := ecdsa.GenerateKey(elliptic.P384(), rand.Reader)
	if err != nil {
		return tls.Certificate{}, "", fmt.Errorf("failed to generate key: %w", err)
	}

	privateKeyBytes, err := x509.MarshalECPrivateKey(privateKey)
	if err != nil {
		return tls.Certificate{}, "", err
	}

	privateKeyPEM := pem.EncodeToMemory(&pem.Block{
		Type:  "EC PRIVATE KEY",
		Bytes: privateKeyBytes,
	})

	// Create CSR
	template := x509.CertificateRequest{
		Subject: pkix.Name{
			Organization: []string{"ngrokd-sdk"},
		},
		SignatureAlgorithm: x509.ECDSAWithSHA384,
	}

	csrDER, err := x509.CreateCertificateRequest(rand.Reader, &template, privateKey)
	if err != nil {
		return tls.Certificate{}, "", err
	}

	csrPEM := pem.EncodeToMemory(&pem.Block{
		Type:  "CERTIFICATE REQUEST",
		Bytes: csrDER,
	})

	// Register with ngrok API
	operator, err := p.apiClient.CreateOperator(ctx, &operatorCreateRequest{
		Description:     "ngrokd-sdk",
		Metadata:        `{"type":"sdk"}`,
		EnabledFeatures: []string{"bindings"},
		Region:          "global",
		Binding: &operatorBindingCreate{
			EndpointSelectors: p.endpointSelectors,
			CSR:               string(csrPEM),
		},
	})
	if err != nil {
		return tls.Certificate{}, "", fmt.Errorf("failed to register: %w", err)
	}

	if operator.Binding == nil || operator.Binding.Cert.Cert == "" {
		return tls.Certificate{}, "", fmt.Errorf("no certificate in response")
	}

	certPEM := []byte(operator.Binding.Cert.Cert)

	// Save to store - if this fails, clean up the operator we just created
	if err := p.store.Save(ctx, privateKeyPEM, certPEM, operator.ID); err != nil {
		// Best-effort cleanup to prevent orphaned operators
		_ = p.apiClient.DeleteOperator(ctx, operator.ID)
		return tls.Certificate{}, "", fmt.Errorf("failed to save certificate: %w", err)
	}

	cert, err := tls.X509KeyPair(certPEM, privateKeyPEM)
	if err != nil {
		return tls.Certificate{}, "", err
	}

	return cert, operator.ID, nil
}