reworked revocation of certificates

Author: KaiserWerk

cmd/certmaker/main.go

@@ -196,7 +196,7 @@ func setupRoutes(cfg *configuration.AppConfig, logger *logrus.Entry, dbSvc *dbse
 	apiRouter.HandleFunc("/root-certificate/obtain", bh.APIRootCertificateDownloadHandler).Methods(http.MethodGet)
 	apiRouter.HandleFunc("/certificate/request-with-simplerequest", bh.APIRequestCertificateWithSimpleRequestHandler).Methods(http.MethodPost)
 	apiRouter.HandleFunc("/certificate/request-with-csr", bh.APIRequestCertificateWithCSRHandler).Methods(http.MethodPost)
-	apiRouter.HandleFunc("/certificate/{sn}/revoke", bh.APIRevokeCertificateHandler).Methods(http.MethodGet)
+	apiRouter.HandleFunc("/certificate/revoke", bh.APIRevokeCertificateHandler).Methods(http.MethodPost)
 	// apiRouter.HandleFunc("/certificate/{id}/obtain", bh.APIObtainCertificateHandler).Methods(http.MethodGet)
 	// apiRouter.HandleFunc("/privatekey/{id}/obtain", bh.APIObtainPrivateKeyHandler).Methods(http.MethodGet)
 	apiRouter.HandleFunc("/http-01/{challengeID}/solve", bh.APISolveHTTP01ChallengeHandler).Methods(http.MethodPost)

internal/entity/revocation_request.go

@@ -0,0 +1,6 @@
+package entity
+
+type RevocationRequest struct {
+	SerialNumber uint64
+	Reason       string
+}

internal/handler/api.go

@@ -853,18 +853,25 @@ func (bh *BaseHandler) APIRevokeCertificateHandler(w http.ResponseWriter, r *htt
 	var (
 		logger = bh.ContextLogger("api")
 		u      = r.Context().Value("user").(*entity.User)
-		vars   = mux.Vars(r)
 	)
 
-	ci, err := bh.DBSvc.FindCertInfo("serial_number = ?", vars["sn"])
+	var revocationRequest entity.RevocationRequest
+	err := json.NewDecoder(r.Body).Decode(&revocationRequest)
+	if err != nil {
+		logger.Debugf("could not decode request body: %s", err.Error())
+		w.WriteHeader(http.StatusBadRequest)
+		return
+	}
+
+	ci, err := bh.DBSvc.FindCertInfo("serial_number = ?", revocationRequest.SerialNumber)
 	if err != nil {
 		logger.Debugf("could not find certinfo: %s", err.Error())
 		w.WriteHeader(http.StatusBadRequest)
 		return
 	}
 
 	if ci.CreatedForUser != u.ID && !u.Admin {
-		logger.Debugf("this is not your certificate")
+		logger.Debugf("This certificate was not issued to the requesting user %d (%s)", u.ID, u.Username)
 		w.WriteHeader(http.StatusForbidden)
 		return
 	}
@@ -881,7 +888,7 @@ func (bh *BaseHandler) APIRevokeCertificateHandler(w http.ResponseWriter, r *htt
 	err = bh.DBSvc.UpdateCertInfo(&ci)
 	if err != nil {
 		logger.Debugf("could not update certinfo: %s", err.Error())
-		w.WriteHeader(http.StatusBadRequest)
+		w.WriteHeader(http.StatusInternalServerError)
 		return
 	}
 }