Workflow

/*
 * R3 Proprietary and Confidential
 *
 * Copyright (c) 2018 R3 Limited.  All rights reserved.
 *
 * The intellectual and technical concepts contained herein are proprietary to R3 and its suppliers and are protected by trade secret law.
 *
 * Distribution of this file or any portion thereof via any medium without the express permission of R3 is strictly prohibited.
 */

package com.r3.enm.workflow.api

import com.r3.enm.model.Request
import com.r3.enm.nsdefaults.ENMDefaults
import net.corda.core.identity.CordaX500Name

/**
 * Workflow plugin interface for adding custom functionality to the network services workflow.
 * @param <R> Type of the request
 */
interface WorkflowPlugin<R : Request> {
    /**
     * Create ticket in the external system. The method will ensure that the ticket is created.
     * The request remains in [RequestStatus.NEW] state and a workflow may keep trying to create the ticket
     * in the external system until the request is updated to [RequestStatus.APPROVED],
     * [RequestStatus.REJECTED] or [RequestStatus.DONE].
     */
    fun createTicket(request: R)

    /**
     * Move ticket status to done state, the status of the request will be updated to [RequestStatus.DONE] once this method is executed successfully.
     */
    fun markAsDone(request: R)

    /**
     * Retrieve ticket with the given request ID.
     */
    fun getRequest(requestId: String): WorkflowPluginRequest?

    /**
     * Runs the interactive shell commands of the plugin.
     */
    fun runCommandDriver() {}

    /**
     * Retrieve the alias for the plugin.
     */
    fun getAlias(): String = ENMDefaults.NOT_AVAILABLE
}

/**
 * Command driver interface for adding custom functionality for interacting with users via the interactive shell
 */
interface CommandDriver {
/**
 * Outputs a menu based on the available commands defined within the class, containing the methods for handling any
 * further interaction logic.
 */
    fun showMenu()
}

/**
 * A class representing the workflow plugin request data.
 */
data class WorkflowPluginRequest(val requestId: String,
                                 val status: RequestStatus,
                                 val modifiedBy: String? = null,
                                 val rejectionData: RejectionData? = null,
                                 val legalName: CordaX500Name? = null)

/*
 * R3 Proprietary and Confidential
 *
 * Copyright (c) 2018 R3 Limited.  All rights reserved.
 *
 * The intellectual and technical concepts contained herein are proprietary to R3 and its suppliers and are protected by trade secret law.
 *
 * Distribution of this file or any portion thereof via any medium without the express permission of R3 is strictly prohibited.
 */

package com.r3.enm.model

import net.corda.core.crypto.SecureHash
import net.corda.core.identity.CordaX500Name
import net.corda.core.serialization.CordaSerializable
import org.bouncycastle.pkcs.PKCS10CertificationRequest
import java.security.cert.CertPath

@CordaSerializable
data class CertificateSigningRequest(override val requestId: String,
                                     override val legalName: CordaX500Name,
                                     val publicKeyHash: SecureHash,
                                     val pkcS10CertificationRequest: PKCS10CertificationRequest,
                                     val signedBy: String?,
                                     val certData: CertificateData?,
                                     val submissionToken: String?) : Request

@CordaSerializable
data class CertificateData(val certStatus: CertificateStatus, val certPath: CertPath)

@CordaSerializable
enum class CertificateStatus {
    VALID, SUSPENDED, REVOKED
}

/*
 * R3 Proprietary and Confidential
 *
 * Copyright (c) 2018 R3 Limited.  All rights reserved.
 *
 * The intellectual and technical concepts contained herein are proprietary to R3 and its suppliers and are protected by trade secret law.
 *
 * Distribution of this file or any portion thereof via any medium without the express permission of R3 is strictly prohibited.
 */

package com.r3.enm.model

import net.corda.core.identity.CordaX500Name
import net.corda.core.serialization.CordaSerializable
import java.math.BigInteger
import java.security.cert.CRLReason
import java.security.cert.X509Certificate
import java.time.Instant

/**
 * This data class is intended to be used internally by certificate revocation request service.
 */
@CordaSerializable
data class CertificateRevocationRequest(override val requestId: String,
                                        val certificateSigningRequestId: String,
                                        val certificate: X509Certificate,
                                        val certificateSerialNumber: BigInteger,
                                        val modifiedAt: Instant,
                                        override val legalName: CordaX500Name,
                                        val reason: CRLReason,
                                        val reporter: String) : Request

package com.r3.enmplugins.example

import com.r3.enm.model.CertificateSigningRequest
import com.r3.enm.model.RejectionReason
import com.r3.enm.workflow.api.RejectionData
import com.r3.enm.workflow.api.RequestStatus
import com.r3.enm.workflow.api.WorkflowPlugin
import com.r3.enm.workflow.api.WorkflowPluginRequest
import com.r3.enm.workflow.api.plugins.PluginLogger
import com.typesafe.config.Config
import net.corda.core.internal.createDirectories
import net.corda.core.internal.list
import org.bouncycastle.openssl.jcajce.JcaPEMWriter
import org.bouncycastle.util.io.pem.PemObject
import java.io.StringWriter
import java.nio.file.Files
import java.nio.file.Path
import java.nio.file.Paths
import java.nio.file.attribute.FileOwnerAttributeView

class FileBaseCSRPlugin(
        config: Config?,
        val logger: PluginLogger
) : WorkflowPlugin<CertificateSigningRequest> {
    private val baseDir = if (config != null) {
        Paths.get(config.getString("baseDir") ?: "workflowDirectory")
    } else {
        Paths.get("workflowDirectory")
    }.also { it.createDirectories() }
    private val approvedFolder = baseDir.resolve("approved").also { it.createDirectories() }
    private val rejectedFolder = baseDir.resolve("rejected").also { it.createDirectories() }
    private val doneFolder = baseDir.resolve("done").also { it.createDirectories() }

    override fun getRequest(requestId: String): WorkflowPluginRequest? {
        logger.info("Retrieving CSR with id $requestId")
        return findWorkflowPluginRequest(requestId, baseDir, RequestStatus.NEW)
                ?: findWorkflowPluginRequest(requestId, approvedFolder, RequestStatus.APPROVED)
                ?: findWorkflowPluginRequest(requestId, rejectedFolder, RequestStatus.REJECTED)
                ?: findWorkflowPluginRequest(requestId, doneFolder, RequestStatus.DONE)
    }

    private fun findWorkflowPluginRequest(requestId: String, directory: Path, status: RequestStatus): WorkflowPluginRequest? {
        return directory.list().findLast { it.toFile().name == requestId }?.let {
            WorkflowPluginRequest(
                    requestId,
                    status,
                    Files.getFileAttributeView(it, FileOwnerAttributeView::class.java).owner.name,
                    RejectionData(RejectionReason.UNKNOWN, "Not specified"))
        }
    }

    override fun createTicket(request: CertificateSigningRequest) {
        val subject = request.legalName

        val data = mapOf(
                "Common Name" to subject.commonName,
                "Organisation" to subject.organisation,
                "Organisation Unit" to subject.organisationUnit,
                "State" to subject.state,
                "Nearest City" to subject.locality,
                "Country" to subject.country,
                "X500 Name" to subject.toString())

        val requestPemString = StringWriter().apply {
            JcaPEMWriter(this).use {
                it.writeObject(PemObject("CERTIFICATE REQUEST", request.pkcS10CertificationRequest.encoded))
            }
        }.toString()

        val ticketDescription = data.filter { it.value != null }.map { "${it.key}: ${it.value}" } + requestPemString

        Files.write(baseDir.resolve(request.requestId), ticketDescription)

        logger.info("Creating Certificate Signing Request ticket for request : ${request.requestId}")
    }

    override fun markAsDone(request: CertificateSigningRequest) {
        logger.info("Marking CSR as done")
        Files.move(approvedFolder.resolve(request.requestId), doneFolder.resolve(request.requestId))
    }
}

class ExamplePlugin(config: Config?, val logger: PluginLogger) : WorkflowPlugin<CertificateSigningRequest> {

    private val done = ConcurrentHashMap<String, WorkflowPluginRequest?>()
    private val approved = ConcurrentHashMap<String, WorkflowPluginRequest?>()
    private val rejected = ConcurrentHashMap<String, WorkflowPluginRequest?>()

    override fun createTicket(request: CertificateSigningRequest) {
        logger.info {"Creating CSR with id ${request.requestId}"}
        if (validate(request.submissionToken)) {
            approved[request.requestId] = WorkflowPluginRequest(request.requestId, RequestStatus.APPROVED, "Me")
        } else {
            rejected[request.requestId] = WorkflowPluginRequest(request.requestId, RequestStatus.REJECTED, "Me", RejectionData(
                RejectionReason.UNPARSEABLE("Missing or unknown CSR token"), "Git gud!")
            )
        }
    }

    override fun getRequest(requestId: String): WorkflowPluginRequest? {
        logger.info { "Fetching request $requestId" }
        return done.getOrDefault(requestId, approved.getOrDefault(requestId, rejected.getOrDefault(requestId, null)))
    }

    override fun markAsDone(request: CertificateSigningRequest) {
        logger.info { "Marking CSR ${request.requestId} as done" }
        with (request.requestId) {
            if (approved.containsKey(this)) {
                done[this] = approved[this]?.copy(status = RequestStatus.DONE)?.also { approved.remove(this) }
            } else if (rejected.contains(this)) {
                done[this] = rejected[this]?.copy(status = RequestStatus.DONE)?.also { rejected.remove(this) }
            }
        }
    }

    private fun validate(token: String?): Boolean {
        return token?.let {
            it == "CENM"
        } ?: false
    }
}