| | | 1 | | using System.Security.Cryptography; |
| | | 2 | | using System.Security.Cryptography.X509Certificates; |
| | | 3 | | using LGDXRobotCloud.API.Configurations; |
| | | 4 | | using LGDXRobotCloud.API.Exceptions; |
| | | 5 | | using LGDXRobotCloud.Data.DbContexts; |
| | | 6 | | using LGDXRobotCloud.Data.Entities; |
| | | 7 | | using LGDXRobotCloud.Data.Models.Business.Administration; |
| | | 8 | | using LGDXRobotCloud.Utilities.Helpers; |
| | | 9 | | using Microsoft.EntityFrameworkCore; |
| | | 10 | | using Microsoft.Extensions.Options; |
| | | 11 | | |
| | | 12 | | namespace LGDXRobotCloud.API.Services.Administration; |
| | | 13 | | |
| | | 14 | | public interface IRobotCertificateService |
| | | 15 | | { |
| | | 16 | | Task<(IEnumerable<RobotCertificateListBusinessModel>, PaginationHelper)> GetRobotCertificatesAsync(int pageNumber, int |
| | | 17 | | Task<RobotCertificateBusinessModel> GetRobotCertificateAsync(Guid robotCertificateId); |
| | | 18 | | RobotCertificateIssueBusinessModel IssueRobotCertificate(Guid robotId); |
| | | 19 | | Task<RobotCertificateRenewBusinessModel> RenewRobotCertificateAsync(RobotCertificateRenewRequestBusinessModel robotCer |
| | | 20 | | |
| | | 21 | | RootCertificateBusinessModel? GetRootCertificate(); |
| | | 22 | | } |
| | | 23 | | |
| | 8 | 24 | | public class RobotCertificateService( |
| | 8 | 25 | | LgdxContext context, |
| | 8 | 26 | | IOptionsSnapshot<LgdxRobotCloudConfiguration> options |
| | 8 | 27 | | ) : IRobotCertificateService |
| | | 28 | | { |
| | 8 | 29 | | private readonly LgdxContext _context = context; |
| | 8 | 30 | | private readonly LgdxRobotCloudConfiguration _lgdxRobotCloudConfiguration = options.Value; |
| | | 31 | | |
| | | 32 | | private record CertificateDetail |
| | | 33 | | { |
| | 6 | 34 | | required public string RootCertificate { get; set; } |
| | 6 | 35 | | required public string RobotCertificatePrivateKey { get; set; } |
| | 6 | 36 | | required public string RobotCertificatePublicKey { get; set; } |
| | 6 | 37 | | required public string RobotCertificateThumbprint { get; set; } |
| | 6 | 38 | | required public DateTime RobotCertificateNotBefore { get; set; } |
| | 6 | 39 | | required public DateTime RobotCertificateNotAfter { get; set; } |
| | | 40 | | } |
| | | 41 | | |
| | | 42 | | public async Task<(IEnumerable<RobotCertificateListBusinessModel>, PaginationHelper)> GetRobotCertificatesAsync(int pa |
| | 1 | 43 | | { |
| | 1 | 44 | | var query = _context.RobotCertificates as IQueryable<RobotCertificate>; |
| | 1 | 45 | | var itemCount = await query.CountAsync(); |
| | 1 | 46 | | var PaginationHelper = new PaginationHelper(itemCount, pageNumber, pageSize); |
| | 1 | 47 | | var robotCertificates = await query.AsNoTracking() |
| | 1 | 48 | | .OrderBy(a => a.Id) |
| | 1 | 49 | | .Skip(pageSize * (pageNumber - 1)) |
| | 1 | 50 | | .Take(pageSize) |
| | 1 | 51 | | .Select(a => new RobotCertificateListBusinessModel { |
| | 1 | 52 | | Id = a.Id, |
| | 1 | 53 | | Thumbprint = a.Thumbprint, |
| | 1 | 54 | | ThumbprintBackup = a.ThumbprintBackup, |
| | 1 | 55 | | NotBefore = a.NotBefore, |
| | 1 | 56 | | NotAfter = a.NotAfter |
| | 1 | 57 | | }) |
| | 1 | 58 | | .ToListAsync(); |
| | 1 | 59 | | return (robotCertificates, PaginationHelper); |
| | 1 | 60 | | } |
| | | 61 | | |
| | | 62 | | public async Task<RobotCertificateBusinessModel> GetRobotCertificateAsync(Guid robotCertificateId) |
| | 2 | 63 | | { |
| | 2 | 64 | | return await _context.RobotCertificates.AsNoTracking() |
| | 2 | 65 | | .Where(a => a.Id == robotCertificateId) |
| | 2 | 66 | | .Include(a => a.Robot) |
| | 2 | 67 | | .Select(a => new RobotCertificateBusinessModel { |
| | 2 | 68 | | Id = a.Id, |
| | 2 | 69 | | RobotId = a.Robot.Id, |
| | 2 | 70 | | RobotName = a.Robot.Name, |
| | 2 | 71 | | Thumbprint = a.Thumbprint, |
| | 2 | 72 | | ThumbprintBackup = a.ThumbprintBackup, |
| | 2 | 73 | | NotBefore = a.NotBefore, |
| | 2 | 74 | | NotAfter = a.NotAfter |
| | 2 | 75 | | }) |
| | 2 | 76 | | .FirstOrDefaultAsync() |
| | 2 | 77 | | ?? throw new LgdxNotFound404Exception(); |
| | 1 | 78 | | } |
| | | 79 | | |
| | | 80 | | private CertificateDetail GenerateRobotCertificate(Guid robotId) |
| | 3 | 81 | | { |
| | 3 | 82 | | X509Store store = new(StoreName.My, StoreLocation.CurrentUser); |
| | 3 | 83 | | store.Open(OpenFlags.OpenExistingOnly); |
| | 11 | 84 | | X509Certificate2 rootCertificate = store.Certificates.First(c => c.SerialNumber == _lgdxRobotCloudConfiguration.Root |
| | | 85 | | |
| | 3 | 86 | | var certificateNotBefore = DateTime.UtcNow; |
| | 3 | 87 | | var certificateNotAfter = DateTimeOffset.UtcNow.AddDays(_lgdxRobotCloudConfiguration.RobotCertificateValidDay); |
| | | 88 | | |
| | 3 | 89 | | var rsa = RSA.Create(); |
| | 3 | 90 | | var certificateRequest = new CertificateRequest("CN=LGDXRobot Cloud Robot Certificate for " + robotId.ToString() + " |
| | 3 | 91 | | var certificate = certificateRequest.Create(rootCertificate, certificateNotBefore, certificateNotAfter, RandomNumber |
| | | 92 | | |
| | 3 | 93 | | return new CertificateDetail { |
| | 3 | 94 | | RootCertificate = rootCertificate.ExportCertificatePem(), |
| | 3 | 95 | | RobotCertificatePrivateKey = new string(PemEncoding.Write("PRIVATE KEY", rsa.ExportPkcs8PrivateKey())), |
| | 3 | 96 | | RobotCertificatePublicKey = certificate.ExportCertificatePem(), |
| | 3 | 97 | | RobotCertificateThumbprint = certificate.Thumbprint, |
| | 3 | 98 | | RobotCertificateNotBefore = certificateNotBefore, |
| | 3 | 99 | | RobotCertificateNotAfter = certificateNotAfter.DateTime |
| | 3 | 100 | | }; |
| | 3 | 101 | | } |
| | | 102 | | |
| | | 103 | | public RobotCertificateIssueBusinessModel IssueRobotCertificate(Guid robotId) |
| | 1 | 104 | | { |
| | 1 | 105 | | var certificate = GenerateRobotCertificate(robotId); |
| | 1 | 106 | | return new RobotCertificateIssueBusinessModel { |
| | 1 | 107 | | RootCertificate = certificate.RootCertificate, |
| | 1 | 108 | | RobotCertificatePrivateKey = certificate.RobotCertificatePrivateKey, |
| | 1 | 109 | | RobotCertificatePublicKey = certificate.RobotCertificatePublicKey, |
| | 1 | 110 | | RobotCertificateThumbprint = certificate.RobotCertificateThumbprint, |
| | 1 | 111 | | RobotCertificateNotBefore = certificate.RobotCertificateNotBefore, |
| | 1 | 112 | | RobotCertificateNotAfter = certificate.RobotCertificateNotAfter |
| | 1 | 113 | | }; |
| | 1 | 114 | | } |
| | | 115 | | |
| | | 116 | | public async Task<RobotCertificateRenewBusinessModel> RenewRobotCertificateAsync(RobotCertificateRenewRequestBusinessM |
| | 3 | 117 | | { |
| | 3 | 118 | | var certificate = _context.RobotCertificates |
| | 3 | 119 | | .Where(c => c.Id == robotCertificateRenewRequestBusinessModel.CertificateId) |
| | 3 | 120 | | .FirstOrDefault() |
| | 3 | 121 | | ?? throw new LgdxNotFound404Exception(); |
| | | 122 | | |
| | 2 | 123 | | var newCertificate = GenerateRobotCertificate(certificate.RobotId); |
| | 2 | 124 | | if (robotCertificateRenewRequestBusinessModel.RevokeOldCertificate) |
| | 1 | 125 | | { |
| | 1 | 126 | | certificate.ThumbprintBackup = null; |
| | 1 | 127 | | } |
| | | 128 | | else |
| | 1 | 129 | | { |
| | 1 | 130 | | certificate.ThumbprintBackup = certificate.Thumbprint; |
| | 1 | 131 | | } |
| | 2 | 132 | | certificate.Thumbprint = newCertificate.RobotCertificateThumbprint; |
| | 2 | 133 | | certificate.NotBefore = DateTime.SpecifyKind(newCertificate.RobotCertificateNotBefore, DateTimeKind.Utc); |
| | 2 | 134 | | certificate.NotAfter = DateTime.SpecifyKind(newCertificate.RobotCertificateNotAfter, DateTimeKind.Utc); |
| | 2 | 135 | | await _context.SaveChangesAsync(); |
| | | 136 | | |
| | 2 | 137 | | var robot = await _context.Robots.AsNoTracking() |
| | 2 | 138 | | .Where(r => r.Id == certificate.RobotId) |
| | 2 | 139 | | .Select(r => new { |
| | 2 | 140 | | r.Id, |
| | 2 | 141 | | r.Name |
| | 2 | 142 | | }) |
| | 2 | 143 | | .FirstOrDefaultAsync() |
| | 2 | 144 | | ?? throw new LgdxNotFound404Exception(); |
| | | 145 | | |
| | 2 | 146 | | return new RobotCertificateRenewBusinessModel { |
| | 2 | 147 | | RobotId = robot.Id, |
| | 2 | 148 | | RobotName = robot.Name, |
| | 2 | 149 | | RootCertificate = newCertificate.RootCertificate, |
| | 2 | 150 | | RobotCertificatePrivateKey = newCertificate.RobotCertificatePrivateKey, |
| | 2 | 151 | | RobotCertificatePublicKey = newCertificate.RobotCertificatePublicKey |
| | 2 | 152 | | }; |
| | 2 | 153 | | } |
| | | 154 | | |
| | | 155 | | public RootCertificateBusinessModel? GetRootCertificate() |
| | 1 | 156 | | { |
| | 1 | 157 | | X509Store store = new(StoreName.My, StoreLocation.CurrentUser); |
| | 1 | 158 | | store.Open(OpenFlags.OpenExistingOnly); |
| | 3 | 159 | | X509Certificate2 rootCertificate = store.Certificates.First(c => c.SerialNumber == _lgdxRobotCloudConfiguration.Root |
| | 1 | 160 | | return new RootCertificateBusinessModel { |
| | 1 | 161 | | NotBefore = rootCertificate.NotBefore.ToUniversalTime(), |
| | 1 | 162 | | NotAfter = rootCertificate.NotAfter.ToUniversalTime(), |
| | 1 | 163 | | PublicKey = rootCertificate.ExportCertificatePem() |
| | 1 | 164 | | }; |
| | 1 | 165 | | } |
| | | 166 | | } |