agentCert.js

Go to the documentation of this file.

 
/**
 * @file agentCert.js
 * @module routes/agentCert
 * @description Agent certificate management endpoints for TLS client authentication.
 * Handles certificate retrieval and CSR (Certificate Signing Request) processing for RMM agents.
 * @requires express
 * @requires crypto
 * @requires services/db
 * @author RMM-PSA Development Team
 * @copyright 2026 RMM-PSA Platform
 * @license Proprietary
 */
 
/**
 * @apiDefine AgentCert Agent Certificates
 * TLS certificate management for agent authentication
 */
 
const express = require('express');
const router = express.Router();
const crypto = require('crypto');
const pool = require('../services/db');
 
 
/**
 * @api {get} /api/agent/:id/cert Get agent certificate
 * @apiName GetAgentCert
 * @apiGroup AgentCert
 * @apiDescription Retrieve TLS certificate and keys for specified agent.
 * Returns both certificate and privateKey (demo implementation echoes public_key).
 * Used by agents for establishing secure communication channels.
 * @apiParam {string} id Agent UUID
 * @apiSuccess {string} certificate Agent TLS certificate
 * @apiSuccess {string} privateKey Agent private key (demo: echoes public_key)
 * @apiError (404) {String} error="Agent not found" Agent UUID not in database
 * @apiError (500) {String} error="Failed to fetch agent cert" Database or crypto error
 * @apiExample {curl} Example:
 *   curl -X GET http://localhost:3000/api/agent/abc-123-uuid/cert
 * @apiSuccessExample {json} Success-Response:
 *   HTTP/1.1 200 OK
 *   {
 *     "certificate": "-----BEGIN CERTIFICATE-----\nMIIC...",
 *     "privateKey": "-----BEGIN RSA PRIVATE KEY-----\nMIIE..."
 *   }
 */
router.get('/:id/cert', async (req, res) => {
  const { id } = req.params;
  try {
    const result = await pool.query(
      'SELECT public_key FROM agents WHERE agent_uuid = $1 LIMIT 1',
      [id]
    );
    if (result.rows.length === 0) {
      return res.status(404).json({ error: 'Agent not found' });
    }
    // For demo, echo public_key as both certificate and privateKey
    res.json({
      certificate: result.rows[0].public_key,
      privateKey: result.rows[0].public_key
    });
  } catch (err) {
    console.error('Error fetching agent cert:', err);
    res.status(500).json({ error: 'Failed to fetch agent cert' });
  }
});
 
/**
 * @api {post} /api/agent/request-cert Request certificate
 * @apiName RequestAgentCert
 * @apiGroup AgentCert
 * @apiDescription Agent submits Certificate Signing Request (CSR) to obtain signed certificate.
 * Stores CSR in database and returns certificate (demo: echoes CSR, production: use CA).
 * Enables agent TLS authentication and secure communications.
 * @apiParam {string} agent_uuid Agent UUID requesting certificate
 * @apiParam {string} csr Certificate Signing Request (PEM format)
 * @apiSuccess {string} certificate Signed certificate (demo: echoes CSR)
 * @apiError (400) {String} error="agent_uuid and csr required" Missing required parameters
 * @apiError (500) {String} error="Failed to process cert request" Database or signing error
 * @apiExample {curl} Example:
 *   curl -X POST http://localhost:3000/api/agent/request-cert \\
 *     -H "Content-Type: application/json" \\
 *     -d '{
 *       "agent_uuid": "abc-123-uuid",
 *       "csr": "-----BEGIN CERTIFICATE REQUEST-----\\nMIIC...\\n-----END CERTIFICATE REQUEST-----"
 *     }'
 * @apiSuccessExample {json} Success-Response:
 *   HTTP/1.1 200 OK
 *   {
 *     "certificate": "-----BEGIN CERTIFICATE-----\nMIIC...\n-----END CERTIFICATE-----"
 *   }
 */
router.post('/request-cert', async (req, res) => {
  const { agent_uuid, csr } = req.body;
  if (!agent_uuid || !csr) {
    return res.status(400).json({ error: 'agent_uuid and csr required' });
  }
  try {
    // For demo: self-sign the CSR (in production, use a CA)
    // Here, just echo back the CSR as the "certificate"
    // TODO: Actually sign the CSR and store the public key
    await pool.query(
      `UPDATE agents SET public_key = $1 WHERE agent_uuid = $2`,
      [csr, agent_uuid]
    );
    res.json({ certificate: csr });
  } catch (err) {
    console.error('Error processing cert request:', err);
    res.status(500).json({ error: 'Failed to process cert request' });
  }
});
 
module.exports = router;