up

src/StellaOps.Cli/Commands/CommandHandlers.cs

@@ -1,9 +1,12 @@
 using System;
+using System.Buffers;
 using System.Collections.Generic;
 using System.Diagnostics;
 using System.Globalization;
 using System.IO;
+using System.Security.Cryptography;
 using System.Text.Json;
+using System.Text;
 using System.Threading;
 using System.Threading.Tasks;
 using Microsoft.Extensions.DependencyInjection;
@@ -15,8 +18,9 @@ using StellaOps.Cli.Prompts;
 using StellaOps.Cli.Services;
 using StellaOps.Cli.Services.Models;
 using StellaOps.Cli.Telemetry;
-
-namespace StellaOps.Cli.Commands;
+using StellaOps.Cryptography;
+
+namespace StellaOps.Cli.Commands;
 
 internal static class CommandHandlers
 {
@@ -598,6 +602,236 @@ internal static class CommandHandlers
         }
     }
 
+    public static async Task HandleAuthRevokeExportAsync(
+        IServiceProvider services,
+        StellaOpsCliOptions options,
+        string? outputDirectory,
+        bool verbose,
+        CancellationToken cancellationToken)
+    {
+        await using var scope = services.CreateAsyncScope();
+        var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("auth-revoke-export");
+        Environment.ExitCode = 0;
+
+        try
+        {
+            var client = scope.ServiceProvider.GetRequiredService<IAuthorityRevocationClient>();
+            var result = await client.ExportAsync(verbose, cancellationToken).ConfigureAwait(false);
+
+            var directory = string.IsNullOrWhiteSpace(outputDirectory)
+                ? Directory.GetCurrentDirectory()
+                : Path.GetFullPath(outputDirectory);
+
+            Directory.CreateDirectory(directory);
+
+            var bundlePath = Path.Combine(directory, "revocation-bundle.json");
+            var signaturePath = Path.Combine(directory, "revocation-bundle.json.jws");
+            var digestPath = Path.Combine(directory, "revocation-bundle.json.sha256");
+
+            await File.WriteAllBytesAsync(bundlePath, result.BundleBytes, cancellationToken).ConfigureAwait(false);
+            await File.WriteAllTextAsync(signaturePath, result.Signature, cancellationToken).ConfigureAwait(false);
+            await File.WriteAllTextAsync(digestPath, $"sha256:{result.Digest}", cancellationToken).ConfigureAwait(false);
+
+            var computedDigest = Convert.ToHexString(SHA256.HashData(result.BundleBytes)).ToLowerInvariant();
+            if (!string.Equals(computedDigest, result.Digest, StringComparison.OrdinalIgnoreCase))
+            {
+                logger.LogError("Digest mismatch. Expected {Expected} but computed {Actual}.", result.Digest, computedDigest);
+                Environment.ExitCode = 1;
+                return;
+            }
+
+            logger.LogInformation(
+                "Revocation bundle exported to {Directory} (sequence {Sequence}, issued {Issued:u}, signing key {KeyId}).",
+                directory,
+                result.Sequence,
+                result.IssuedAt,
+                string.IsNullOrWhiteSpace(result.SigningKeyId) ? "<unknown>" : result.SigningKeyId);
+        }
+        catch (Exception ex)
+        {
+            logger.LogError(ex, "Failed to export revocation bundle.");
+            Environment.ExitCode = 1;
+        }
+    }
+
+    public static async Task HandleAuthRevokeVerifyAsync(
+        string bundlePath,
+        string signaturePath,
+        string keyPath,
+        bool verbose,
+        CancellationToken cancellationToken)
+    {
+        var loggerFactory = LoggerFactory.Create(builder => builder.AddSimpleConsole(options =>
+        {
+            options.SingleLine = true;
+            options.TimestampFormat = "HH:mm:ss ";
+        }));
+        var logger = loggerFactory.CreateLogger("auth-revoke-verify");
+        Environment.ExitCode = 0;
+
+        try
+        {
+            if (string.IsNullOrWhiteSpace(bundlePath) || string.IsNullOrWhiteSpace(signaturePath) || string.IsNullOrWhiteSpace(keyPath))
+            {
+                logger.LogError("Arguments --bundle, --signature, and --key are required.");
+                Environment.ExitCode = 1;
+                return;
+            }
+
+            var bundleBytes = await File.ReadAllBytesAsync(bundlePath, cancellationToken).ConfigureAwait(false);
+            var signatureContent = (await File.ReadAllTextAsync(signaturePath, cancellationToken).ConfigureAwait(false)).Trim();
+            var keyPem = await File.ReadAllTextAsync(keyPath, cancellationToken).ConfigureAwait(false);
+
+            var digest = Convert.ToHexString(SHA256.HashData(bundleBytes)).ToLowerInvariant();
+            logger.LogInformation("Bundle digest sha256:{Digest}", digest);
+
+            if (!TryParseDetachedJws(signatureContent, out var encodedHeader, out var encodedSignature))
+            {
+                logger.LogError("Signature is not in detached JWS format.");
+                Environment.ExitCode = 1;
+                return;
+            }
+
+            var headerJson = Encoding.UTF8.GetString(Base64UrlDecode(encodedHeader));
+            using var headerDocument = JsonDocument.Parse(headerJson);
+            var header = headerDocument.RootElement;
+
+            if (!header.TryGetProperty("b64", out var b64Element) || b64Element.GetBoolean())
+            {
+                logger.LogError("Detached JWS header must include '\"b64\": false'.");
+                Environment.ExitCode = 1;
+                return;
+            }
+
+            var algorithm = header.TryGetProperty("alg", out var algElement) ? algElement.GetString() : SignatureAlgorithms.Es256;
+            if (string.IsNullOrWhiteSpace(algorithm))
+            {
+                algorithm = SignatureAlgorithms.Es256;
+            }
+
+            var hashAlgorithm = ResolveHashAlgorithm(algorithm);
+            if (hashAlgorithm is null)
+            {
+                logger.LogError("Unsupported signing algorithm '{Algorithm}'.", algorithm);
+                Environment.ExitCode = 1;
+                return;
+            }
+
+            using var ecdsa = ECDsa.Create();
+            try
+            {
+                ecdsa.ImportFromPem(keyPem);
+            }
+            catch (CryptographicException ex)
+            {
+                logger.LogError(ex, "Failed to import signing key.");
+                Environment.ExitCode = 1;
+                return;
+            }
+
+            var signingInputLength = encodedHeader.Length + 1 + bundleBytes.Length;
+            var buffer = ArrayPool<byte>.Shared.Rent(signingInputLength);
+            try
+            {
+                var headerBytes = Encoding.ASCII.GetBytes(encodedHeader);
+                Buffer.BlockCopy(headerBytes, 0, buffer, 0, headerBytes.Length);
+                buffer[headerBytes.Length] = (byte)'.';
+                Buffer.BlockCopy(bundleBytes, 0, buffer, headerBytes.Length + 1, bundleBytes.Length);
+
+                var signatureBytes = Base64UrlDecode(encodedSignature);
+                var verified = ecdsa.VerifyData(new ReadOnlySpan<byte>(buffer, 0, signingInputLength), signatureBytes, hashAlgorithm.Value);
+
+                if (!verified)
+                {
+                    logger.LogError("Signature verification failed.");
+                    Environment.ExitCode = 1;
+                    return;
+                }
+            }
+            finally
+            {
+                ArrayPool<byte>.Shared.Return(buffer);
+            }
+
+            logger.LogInformation("Signature verified using algorithm {Algorithm}.", algorithm);
+
+            if (verbose)
+            {
+                logger.LogInformation("JWS header: {Header}", headerJson);
+            }
+        }
+        catch (Exception ex)
+        {
+            logger.LogError(ex, "Failed to verify revocation bundle.");
+            Environment.ExitCode = 1;
+        }
+        finally
+        {
+            loggerFactory.Dispose();
+        }
+    }
+
+    private static bool TryParseDetachedJws(string value, out string encodedHeader, out string encodedSignature)
+    {
+        encodedHeader = string.Empty;
+        encodedSignature = string.Empty;
+
+        if (string.IsNullOrWhiteSpace(value))
+        {
+            return false;
+        }
+
+        var parts = value.Split('.');
+        if (parts.Length != 3)
+        {
+            return false;
+        }
+
+        encodedHeader = parts[0];
+        encodedSignature = parts[2];
+        return parts[1].Length == 0;
+    }
+
+    private static byte[] Base64UrlDecode(string value)
+    {
+        var normalized = value.Replace('-', '+').Replace('_', '/');
+        var padding = normalized.Length % 4;
+        if (padding == 2)
+        {
+            normalized += "==";
+        }
+        else if (padding == 3)
+        {
+            normalized += "=";
+        }
+        else if (padding == 1)
+        {
+            throw new FormatException("Invalid Base64Url value.");
+        }
+
+        return Convert.FromBase64String(normalized);
+    }
+
+    private static HashAlgorithmName? ResolveHashAlgorithm(string algorithm)
+    {
+        if (string.Equals(algorithm, SignatureAlgorithms.Es256, StringComparison.OrdinalIgnoreCase))
+        {
+            return HashAlgorithmName.SHA256;
+        }
+
+        if (string.Equals(algorithm, SignatureAlgorithms.Es384, StringComparison.OrdinalIgnoreCase))
+        {
+            return HashAlgorithmName.SHA384;
+        }
+
+        if (string.Equals(algorithm, SignatureAlgorithms.Es512, StringComparison.OrdinalIgnoreCase))
+        {
+            return HashAlgorithmName.SHA512;
+        }
+
+        return null;
+    }
+
     private static string FormatDuration(TimeSpan duration)
     {
         if (duration <= TimeSpan.Zero)