up

src/StellaOps.Cli/Commands/CommandFactory.cs

@@ -262,10 +262,51 @@ internal static class CommandFactory
             return CommandHandlers.HandleAuthWhoAmIAsync(services, options, verbose, cancellationToken);
         });
 
+        var revoke = new Command("revoke", "Manage revocation exports.");
+        var export = new Command("export", "Export the revocation bundle and signature to disk.");
+        var outputOption = new Option<string?>("--output")
+        {
+            Description = "Directory to write exported revocation files (defaults to current directory)."
+        };
+        export.Add(outputOption);
+        export.SetAction((parseResult, _) =>
+        {
+            var output = parseResult.GetValue(outputOption);
+            var verbose = parseResult.GetValue(verboseOption);
+            return CommandHandlers.HandleAuthRevokeExportAsync(services, options, output, verbose, cancellationToken);
+        });
+        revoke.Add(export);
+        var verify = new Command("verify", "Verify a revocation bundle against a detached JWS signature.");
+        var bundleOption = new Option<string>("--bundle")
+        {
+            Description = "Path to the revocation-bundle.json file."
+        };
+        var signatureOption = new Option<string>("--signature")
+        {
+            Description = "Path to the revocation-bundle.json.jws file."
+        };
+        var keyOption = new Option<string>("--key")
+        {
+            Description = "Path to the PEM-encoded public/private key used for verification."
+        };
+        verify.Add(bundleOption);
+        verify.Add(signatureOption);
+        verify.Add(keyOption);
+        verify.SetAction((parseResult, _) =>
+        {
+            var bundlePath = parseResult.GetValue(bundleOption) ?? string.Empty;
+            var signaturePath = parseResult.GetValue(signatureOption) ?? string.Empty;
+            var keyPath = parseResult.GetValue(keyOption) ?? string.Empty;
+            var verbose = parseResult.GetValue(verboseOption);
+            return CommandHandlers.HandleAuthRevokeVerifyAsync(bundlePath, signaturePath, keyPath, verbose, cancellationToken);
+        });
+        revoke.Add(verify);
+
         auth.Add(login);
         auth.Add(logout);
         auth.Add(status);
         auth.Add(whoami);
+        auth.Add(revoke);
         return auth;
     }
 

src/StellaOps.Cli/Commands/CommandHandlers.cs

@@ -1,9 +1,12 @@
 using System;
+using System.Buffers;
 using System.Collections.Generic;
 using System.Diagnostics;
 using System.Globalization;
 using System.IO;
+using System.Security.Cryptography;
 using System.Text.Json;
+using System.Text;
 using System.Threading;
 using System.Threading.Tasks;
 using Microsoft.Extensions.DependencyInjection;
@@ -15,8 +18,9 @@ using StellaOps.Cli.Prompts;
 using StellaOps.Cli.Services;
 using StellaOps.Cli.Services.Models;
 using StellaOps.Cli.Telemetry;
-
-namespace StellaOps.Cli.Commands;
+using StellaOps.Cryptography;
+
+namespace StellaOps.Cli.Commands;
 
 internal static class CommandHandlers
 {
@@ -598,6 +602,236 @@ internal static class CommandHandlers
         }
     }
 
+    public static async Task HandleAuthRevokeExportAsync(
+        IServiceProvider services,
+        StellaOpsCliOptions options,
+        string? outputDirectory,
+        bool verbose,
+        CancellationToken cancellationToken)
+    {
+        await using var scope = services.CreateAsyncScope();
+        var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("auth-revoke-export");
+        Environment.ExitCode = 0;
+
+        try
+        {
+            var client = scope.ServiceProvider.GetRequiredService<IAuthorityRevocationClient>();
+            var result = await client.ExportAsync(verbose, cancellationToken).ConfigureAwait(false);
+
+            var directory = string.IsNullOrWhiteSpace(outputDirectory)
+                ? Directory.GetCurrentDirectory()
+                : Path.GetFullPath(outputDirectory);
+
+            Directory.CreateDirectory(directory);
+
+            var bundlePath = Path.Combine(directory, "revocation-bundle.json");
+            var signaturePath = Path.Combine(directory, "revocation-bundle.json.jws");
+            var digestPath = Path.Combine(directory, "revocation-bundle.json.sha256");
+
+            await File.WriteAllBytesAsync(bundlePath, result.BundleBytes, cancellationToken).ConfigureAwait(false);
+            await File.WriteAllTextAsync(signaturePath, result.Signature, cancellationToken).ConfigureAwait(false);
+            await File.WriteAllTextAsync(digestPath, $"sha256:{result.Digest}", cancellationToken).ConfigureAwait(false);
+
+            var computedDigest = Convert.ToHexString(SHA256.HashData(result.BundleBytes)).ToLowerInvariant();
+            if (!string.Equals(computedDigest, result.Digest, StringComparison.OrdinalIgnoreCase))
+            {
+                logger.LogError("Digest mismatch. Expected {Expected} but computed {Actual}.", result.Digest, computedDigest);
+                Environment.ExitCode = 1;
+                return;
+            }
+
+            logger.LogInformation(
+                "Revocation bundle exported to {Directory} (sequence {Sequence}, issued {Issued:u}, signing key {KeyId}).",
+                directory,
+                result.Sequence,
+                result.IssuedAt,
+                string.IsNullOrWhiteSpace(result.SigningKeyId) ? "<unknown>" : result.SigningKeyId);
+        }
+        catch (Exception ex)
+        {
+            logger.LogError(ex, "Failed to export revocation bundle.");
+            Environment.ExitCode = 1;
+        }
+    }
+
+    public static async Task HandleAuthRevokeVerifyAsync(
+        string bundlePath,
+        string signaturePath,
+        string keyPath,
+        bool verbose,
+        CancellationToken cancellationToken)
+    {
+        var loggerFactory = LoggerFactory.Create(builder => builder.AddSimpleConsole(options =>
+        {
+            options.SingleLine = true;
+            options.TimestampFormat = "HH:mm:ss ";
+        }));
+        var logger = loggerFactory.CreateLogger("auth-revoke-verify");
+        Environment.ExitCode = 0;
+
+        try
+        {
+            if (string.IsNullOrWhiteSpace(bundlePath) || string.IsNullOrWhiteSpace(signaturePath) || string.IsNullOrWhiteSpace(keyPath))
+            {
+                logger.LogError("Arguments --bundle, --signature, and --key are required.");
+                Environment.ExitCode = 1;
+                return;
+            }
+
+            var bundleBytes = await File.ReadAllBytesAsync(bundlePath, cancellationToken).ConfigureAwait(false);
+            var signatureContent = (await File.ReadAllTextAsync(signaturePath, cancellationToken).ConfigureAwait(false)).Trim();
+            var keyPem = await File.ReadAllTextAsync(keyPath, cancellationToken).ConfigureAwait(false);
+
+            var digest = Convert.ToHexString(SHA256.HashData(bundleBytes)).ToLowerInvariant();
+            logger.LogInformation("Bundle digest sha256:{Digest}", digest);
+
+            if (!TryParseDetachedJws(signatureContent, out var encodedHeader, out var encodedSignature))
+            {
+                logger.LogError("Signature is not in detached JWS format.");
+                Environment.ExitCode = 1;
+                return;
+            }
+
+            var headerJson = Encoding.UTF8.GetString(Base64UrlDecode(encodedHeader));
+            using var headerDocument = JsonDocument.Parse(headerJson);
+            var header = headerDocument.RootElement;
+
+            if (!header.TryGetProperty("b64", out var b64Element) || b64Element.GetBoolean())
+            {
+                logger.LogError("Detached JWS header must include '\"b64\": false'.");
+                Environment.ExitCode = 1;
+                return;
+            }
+
+            var algorithm = header.TryGetProperty("alg", out var algElement) ? algElement.GetString() : SignatureAlgorithms.Es256;
+            if (string.IsNullOrWhiteSpace(algorithm))
+            {
+                algorithm = SignatureAlgorithms.Es256;
+            }
+
+            var hashAlgorithm = ResolveHashAlgorithm(algorithm);
+            if (hashAlgorithm is null)
+            {
+                logger.LogError("Unsupported signing algorithm '{Algorithm}'.", algorithm);
+                Environment.ExitCode = 1;
+                return;
+            }
+
+            using var ecdsa = ECDsa.Create();
+            try
+            {
+                ecdsa.ImportFromPem(keyPem);
+            }
+            catch (CryptographicException ex)
+            {
+                logger.LogError(ex, "Failed to import signing key.");
+                Environment.ExitCode = 1;
+                return;
+            }
+
+            var signingInputLength = encodedHeader.Length + 1 + bundleBytes.Length;
+            var buffer = ArrayPool<byte>.Shared.Rent(signingInputLength);
+            try
+            {
+                var headerBytes = Encoding.ASCII.GetBytes(encodedHeader);
+                Buffer.BlockCopy(headerBytes, 0, buffer, 0, headerBytes.Length);
+                buffer[headerBytes.Length] = (byte)'.';
+                Buffer.BlockCopy(bundleBytes, 0, buffer, headerBytes.Length + 1, bundleBytes.Length);
+
+                var signatureBytes = Base64UrlDecode(encodedSignature);
+                var verified = ecdsa.VerifyData(new ReadOnlySpan<byte>(buffer, 0, signingInputLength), signatureBytes, hashAlgorithm.Value);
+
+                if (!verified)
+                {
+                    logger.LogError("Signature verification failed.");
+                    Environment.ExitCode = 1;
+                    return;
+                }
+            }
+            finally
+            {
+                ArrayPool<byte>.Shared.Return(buffer);
+            }
+
+            logger.LogInformation("Signature verified using algorithm {Algorithm}.", algorithm);
+
+            if (verbose)
+            {
+                logger.LogInformation("JWS header: {Header}", headerJson);
+            }
+        }
+        catch (Exception ex)
+        {
+            logger.LogError(ex, "Failed to verify revocation bundle.");
+            Environment.ExitCode = 1;
+        }
+        finally
+        {
+            loggerFactory.Dispose();
+        }
+    }
+
+    private static bool TryParseDetachedJws(string value, out string encodedHeader, out string encodedSignature)
+    {
+        encodedHeader = string.Empty;
+        encodedSignature = string.Empty;
+
+        if (string.IsNullOrWhiteSpace(value))
+        {
+            return false;
+        }
+
+        var parts = value.Split('.');
+        if (parts.Length != 3)
+        {
+            return false;
+        }
+
+        encodedHeader = parts[0];
+        encodedSignature = parts[2];
+        return parts[1].Length == 0;
+    }
+
+    private static byte[] Base64UrlDecode(string value)
+    {
+        var normalized = value.Replace('-', '+').Replace('_', '/');
+        var padding = normalized.Length % 4;
+        if (padding == 2)
+        {
+            normalized += "==";
+        }
+        else if (padding == 3)
+        {
+            normalized += "=";
+        }
+        else if (padding == 1)
+        {
+            throw new FormatException("Invalid Base64Url value.");
+        }
+
+        return Convert.FromBase64String(normalized);
+    }
+
+    private static HashAlgorithmName? ResolveHashAlgorithm(string algorithm)
+    {
+        if (string.Equals(algorithm, SignatureAlgorithms.Es256, StringComparison.OrdinalIgnoreCase))
+        {
+            return HashAlgorithmName.SHA256;
+        }
+
+        if (string.Equals(algorithm, SignatureAlgorithms.Es384, StringComparison.OrdinalIgnoreCase))
+        {
+            return HashAlgorithmName.SHA384;
+        }
+
+        if (string.Equals(algorithm, SignatureAlgorithms.Es512, StringComparison.OrdinalIgnoreCase))
+        {
+            return HashAlgorithmName.SHA512;
+        }
+
+        return null;
+    }
+
     private static string FormatDuration(TimeSpan duration)
     {
         if (duration <= TimeSpan.Zero)

src/StellaOps.Cli/Program.cs

@@ -81,6 +81,15 @@ internal static class Program
                 Directory.CreateDirectory(cacheDirectory);
                 services.AddStellaOpsFileTokenCache(cacheDirectory);
             }
+
+            services.AddHttpClient<IAuthorityRevocationClient, AuthorityRevocationClient>(client =>
+            {
+                client.Timeout = TimeSpan.FromMinutes(2);
+                if (Uri.TryCreate(options.Authority.Url, UriKind.Absolute, out var authorityUri))
+                {
+                    client.BaseAddress = authorityUri;
+                }
+            });
         }
 
         services.AddHttpClient<IBackendOperationsClient, BackendOperationsClient>(client =>

src/StellaOps.Cli/Services/AuthorityRevocationClient.cs

@@ -0,0 +1,213 @@
+using System;
+using System.Buffers.Text;
+using System.Net.Http;
+using System.Net.Http.Headers;
+using System.Text.Json;
+using System.Text.Json.Serialization;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Extensions.Logging;
+using StellaOps.Auth.Client;
+using StellaOps.Cli.Configuration;
+using StellaOps.Cli.Services.Models;
+
+namespace StellaOps.Cli.Services;
+
+internal sealed class AuthorityRevocationClient : IAuthorityRevocationClient
+{
+    private static readonly JsonSerializerOptions SerializerOptions = new(JsonSerializerDefaults.Web);
+    private static readonly TimeSpan TokenRefreshSkew = TimeSpan.FromSeconds(30);
+
+    private readonly HttpClient httpClient;
+    private readonly StellaOpsCliOptions options;
+    private readonly ILogger<AuthorityRevocationClient> logger;
+    private readonly IStellaOpsTokenClient? tokenClient;
+    private readonly object tokenSync = new();
+
+    private string? cachedAccessToken;
+    private DateTimeOffset cachedAccessTokenExpiresAt = DateTimeOffset.MinValue;
+
+    public AuthorityRevocationClient(
+        HttpClient httpClient,
+        StellaOpsCliOptions options,
+        ILogger<AuthorityRevocationClient> logger,
+        IStellaOpsTokenClient? tokenClient = null)
+    {
+        this.httpClient = httpClient ?? throw new ArgumentNullException(nameof(httpClient));
+        this.options = options ?? throw new ArgumentNullException(nameof(options));
+        this.logger = logger ?? throw new ArgumentNullException(nameof(logger));
+        this.tokenClient = tokenClient;
+
+        if (!string.IsNullOrWhiteSpace(options.Authority?.Url) && httpClient.BaseAddress is null && Uri.TryCreate(options.Authority.Url, UriKind.Absolute, out var authorityUri))
+        {
+            httpClient.BaseAddress = authorityUri;
+        }
+    }
+
+    public async Task<AuthorityRevocationExportResult> ExportAsync(bool verbose, CancellationToken cancellationToken)
+    {
+        EnsureAuthorityConfigured();
+
+        using var request = new HttpRequestMessage(HttpMethod.Get, "internal/revocations/export");
+        var accessToken = await AcquireAccessTokenAsync(cancellationToken).ConfigureAwait(false);
+        if (!string.IsNullOrWhiteSpace(accessToken))
+        {
+            request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", accessToken);
+        }
+
+        using var response = await httpClient.SendAsync(request, cancellationToken).ConfigureAwait(false);
+        if (!response.IsSuccessStatusCode)
+        {
+            var body = await response.Content.ReadAsStringAsync(cancellationToken).ConfigureAwait(false);
+            var message = $"Authority export request failed with {(int)response.StatusCode} {response.ReasonPhrase}: {body}";
+            throw new InvalidOperationException(message);
+        }
+
+        var payload = await JsonSerializer.DeserializeAsync<ExportResponseDto>(
+            await response.Content.ReadAsStreamAsync(cancellationToken).ConfigureAwait(false),
+            SerializerOptions,
+            cancellationToken).ConfigureAwait(false);
+
+        if (payload is null)
+        {
+            throw new InvalidOperationException("Authority export response payload was empty.");
+        }
+
+        var bundleBytes = Convert.FromBase64String(payload.Bundle.Data);
+        var digest = payload.Digest?.Value ?? string.Empty;
+
+        if (verbose)
+        {
+            logger.LogInformation("Received revocation export sequence {Sequence} (sha256:{Digest}, signing key {KeyId}).", payload.Sequence, digest, payload.SigningKeyId ?? "<unspecified>");
+        }
+
+        return new AuthorityRevocationExportResult
+        {
+            BundleBytes = bundleBytes,
+            Signature = payload.Signature?.Value ?? string.Empty,
+            Digest = digest,
+            Sequence = payload.Sequence,
+            IssuedAt = payload.IssuedAt,
+            SigningKeyId = payload.SigningKeyId
+        };
+    }
+
+    private async Task<string?> AcquireAccessTokenAsync(CancellationToken cancellationToken)
+    {
+        if (tokenClient is null)
+        {
+            return null;
+        }
+
+        lock (tokenSync)
+        {
+            if (!string.IsNullOrEmpty(cachedAccessToken) && cachedAccessTokenExpiresAt - TokenRefreshSkew > DateTimeOffset.UtcNow)
+            {
+                return cachedAccessToken;
+            }
+        }
+
+        var scope = AuthorityTokenUtilities.ResolveScope(options);
+        var token = await RequestAccessTokenAsync(scope, cancellationToken).ConfigureAwait(false);
+
+        lock (tokenSync)
+        {
+            cachedAccessToken = token.AccessToken;
+            cachedAccessTokenExpiresAt = token.ExpiresAtUtc;
+            return cachedAccessToken;
+        }
+    }
+
+    private async Task<StellaOpsTokenResult> RequestAccessTokenAsync(string scope, CancellationToken cancellationToken)
+    {
+        if (options.Authority is null)
+        {
+            throw new InvalidOperationException("Authority credentials are not configured.");
+        }
+
+        if (!string.IsNullOrWhiteSpace(options.Authority.Username))
+        {
+            if (string.IsNullOrWhiteSpace(options.Authority.Password))
+            {
+                throw new InvalidOperationException("Authority password must be configured or run 'auth login'.");
+            }
+
+            return await tokenClient!.RequestPasswordTokenAsync(
+                options.Authority.Username,
+                options.Authority.Password!,
+                scope,
+                cancellationToken).ConfigureAwait(false);
+        }
+
+        return await tokenClient!.RequestClientCredentialsTokenAsync(scope, cancellationToken).ConfigureAwait(false);
+    }
+
+    private void EnsureAuthorityConfigured()
+    {
+        if (string.IsNullOrWhiteSpace(options.Authority?.Url))
+        {
+            throw new InvalidOperationException("Authority URL is not configured. Set STELLAOPS_AUTHORITY_URL or update stellaops.yaml.");
+        }
+
+        if (httpClient.BaseAddress is null)
+        {
+            if (!Uri.TryCreate(options.Authority.Url, UriKind.Absolute, out var baseUri))
+            {
+                throw new InvalidOperationException("Authority URL is invalid.");
+            }
+
+            httpClient.BaseAddress = baseUri;
+        }
+    }
+
+    private sealed class ExportResponseDto
+    {
+        [JsonPropertyName("schemaVersion")]
+        public string SchemaVersion { get; set; } = string.Empty;
+
+        [JsonPropertyName("bundleId")]
+        public string BundleId { get; set; } = string.Empty;
+
+        [JsonPropertyName("sequence")]
+        public long Sequence { get; set; }
+
+        [JsonPropertyName("issuedAt")]
+        public DateTimeOffset IssuedAt { get; set; }
+
+        [JsonPropertyName("signingKeyId")]
+        public string? SigningKeyId { get; set; }
+
+        [JsonPropertyName("bundle")]
+        public ExportPayloadDto Bundle { get; set; } = new();
+
+        [JsonPropertyName("signature")]
+        public ExportSignatureDto? Signature { get; set; }
+
+        [JsonPropertyName("digest")]
+        public ExportDigestDto? Digest { get; set; }
+    }
+
+    private sealed class ExportPayloadDto
+    {
+        [JsonPropertyName("data")]
+        public string Data { get; set; } = string.Empty;
+    }
+
+    private sealed class ExportSignatureDto
+    {
+        [JsonPropertyName("algorithm")]
+        public string Algorithm { get; set; } = string.Empty;
+
+        [JsonPropertyName("keyId")]
+        public string KeyId { get; set; } = string.Empty;
+
+        [JsonPropertyName("value")]
+        public string Value { get; set; } = string.Empty;
+    }
+
+    private sealed class ExportDigestDto
+    {
+        [JsonPropertyName("value")]
+        public string Value { get; set; } = string.Empty;
+    }
+}

src/StellaOps.Cli/Services/IAuthorityRevocationClient.cs

@@ -0,0 +1,10 @@
+using System.Threading;
+using System.Threading.Tasks;
+using StellaOps.Cli.Services.Models;
+
+namespace StellaOps.Cli.Services;
+
+internal interface IAuthorityRevocationClient
+{
+    Task<AuthorityRevocationExportResult> ExportAsync(bool verbose, CancellationToken cancellationToken);
+}

src/StellaOps.Cli/Services/Models/AuthorityRevocationExportResult.cs

@@ -0,0 +1,18 @@
+using System;
+
+namespace StellaOps.Cli.Services.Models;
+
+internal sealed class AuthorityRevocationExportResult
+{
+    public required byte[] BundleBytes { get; init; }
+
+    public required string Signature { get; init; }
+
+    public required string Digest { get; init; }
+
+    public required long Sequence { get; init; }
+
+    public required DateTimeOffset IssuedAt { get; init; }
+
+    public string? SigningKeyId { get; init; }
+}