diff --git a/trifid-pki/tarpaulin-report.html b/trifid-pki/tarpaulin-report.html
index 1357d5a..14a8594 100644
--- a/trifid-pki/tarpaulin-report.html
+++ b/trifid-pki/tarpaulin-report.html
@@ -107,8 +107,8 @@
 <body>
     <div id="root"></div>
     <script>
-        var data = {"files":[{"path":["/","home","core","prj","e3t","trifid","tfclient","src","main.rs"],"content":"fn main() {\n    println!(\"Hello, world!\");\n}\n","traces":[],"covered":0,"coverable":0},{"path":["/","home","core","prj","e3t","trifid","trifid-api","build.rs"],"content":"// generated by `sqlx migrate build-script`\nfn main() {\n    // trigger recompilation when a new migration is added\n    println!(\"cargo:rerun-if-changed=migrations\");\n}","traces":[],"covered":0,"coverable":0},{"path":["/","home","core","prj","e3t","trifid","trifid-api","src","auth.rs"],"content":"use rocket::http::Status;\nuse rocket::{Request};\nuse rocket::request::{FromRequest, Outcome};\nuse crate::tokens::{validate_auth_token, validate_session_token};\n\npub struct PartialUserInfo {\n    pub user_id: i32,\n    pub created_at: i64,\n    pub email: String,\n    pub has_totp_auth: bool,\n\n    pub session_id: String,\n    pub auth_id: Option\u003cString\u003e\n}\n\n#[derive(Debug)]\npub enum AuthenticationError {\n    MissingToken,\n    InvalidToken(usize),\n    DatabaseError,\n    RequiresTOTP\n}\n\n#[rocket::async_trait]\nimpl\u003c'r\u003e FromRequest\u003c'r\u003e for PartialUserInfo {\n    type Error = AuthenticationError;\n\n    async fn from_request(req: \u0026'r Request\u003c'_\u003e) -\u003e Outcome\u003cSelf, Self::Error\u003e {\n        let headers = req.headers();\n\n        // make sure the bearer token exists\n        if let Some(authorization) = headers.get_one(\"Authorization\") {\n            // parse bearer token\n            let components = authorization.split(' ').collect::\u003cVec\u003c\u0026str\u003e\u003e();\n\n            if components.len() != 2 \u0026\u0026 components.len() != 3 {\n                return Outcome::Failure((Status::Unauthorized, AuthenticationError::MissingToken));\n            }\n\n            if components[0] != \"Bearer\" {\n                return Outcome::Failure((Status::Unauthorized, AuthenticationError::InvalidToken(0)));\n            }\n\n            if components.len() == 2 \u0026\u0026 !components[1].starts_with(\"st-\") {\n                return Outcome::Failure((Status::Unauthorized, AuthenticationError::InvalidToken(1)));\n            }\n\n            let st: String;\n            let user_id: i64;\n            let at: Option\u003cString\u003e;\n\n            match \u0026components[1][..3] {\n                \"st-\" =\u003e {\n                    // validate session token\n                    st = components[1].to_string();\n                    match validate_session_token(st.clone(), req.rocket().state().unwrap()).await {\n                        Ok(uid) =\u003e user_id = uid,\n                        Err(_) =\u003e return Outcome::Failure((Status::Unauthorized, AuthenticationError::InvalidToken(2)))\n                    }\n                },\n                _ =\u003e return Outcome::Failure((Status::Unauthorized, AuthenticationError::InvalidToken(3)))\n            }\n\n            if components.len() == 3 {\n                match \u0026components[2][..3] {\n                    \"at-\" =\u003e {\n                        // validate auth token\n                        at = Some(components[2].to_string());\n                        match validate_auth_token(at.clone().unwrap().clone(), st.clone(), req.rocket().state().unwrap()).await {\n                            Ok(_) =\u003e (),\n                            Err(_) =\u003e return Outcome::Failure((Status::Unauthorized, AuthenticationError::InvalidToken(4)))\n                        }\n                    },\n                    _ =\u003e return Outcome::Failure((Status::Unauthorized, AuthenticationError::InvalidToken(5)))\n                }\n            } else {\n                at = None;\n            }\n\n            // this user is 100% valid and authenticated, fetch their info\n\n            let user = match sqlx::query!(\"SELECT * FROM users WHERE id = $1\", user_id.clone() as i32).fetch_one(req.rocket().state().unwrap()).await {\n                Ok(u) =\u003e u,\n                Err(_) =\u003e return Outcome::Failure((Status::InternalServerError, AuthenticationError::DatabaseError))\n            };\n\n            Outcome::Success(PartialUserInfo {\n                user_id: user_id as i32,\n                created_at: user.created_on as i64,\n                email: user.email,\n                has_totp_auth: at.is_some(),\n                session_id: st,\n                auth_id: at,\n            })\n        } else {\n            Outcome::Failure((Status::Unauthorized, AuthenticationError::MissingToken))\n        }\n    }\n}\n\npub struct TOTPAuthenticatedUserInfo {\n    pub user_id: i32,\n    pub created_at: i64,\n    pub email: String,\n}\n#[rocket::async_trait]\nimpl\u003c'r\u003e FromRequest\u003c'r\u003e for TOTPAuthenticatedUserInfo {\n    type Error = AuthenticationError;\n\n    async fn from_request(request: \u0026'r Request\u003c'_\u003e) -\u003e Outcome\u003cSelf, Self::Error\u003e {\n        let userinfo = PartialUserInfo::from_request(request).await;\n        match userinfo {\n            Outcome::Failure(e) =\u003e Outcome::Failure(e),\n            Outcome::Forward(f) =\u003e Outcome::Forward(f),\n            Outcome::Success(s) =\u003e {\n                if s.has_totp_auth {\n                    Outcome::Success(Self {\n                        user_id: s.user_id,\n                        created_at: s.created_at,\n                        email: s.email,\n                    })\n                } else {\n                    Outcome::Failure((Status::Unauthorized, AuthenticationError::RequiresTOTP))\n                }\n            }\n        }\n    }\n}","traces":[{"line":28,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":29,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":32,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":34,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":36,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":37,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":40,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":41,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":44,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":45,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":48,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":49,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":50,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":52,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":53,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":55,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":56,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":57,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":58,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":61,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":64,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":65,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":66,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":68,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":69,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":70,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":71,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":74,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":77,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":82,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":83,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":84,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":87,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":88,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":89,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":90,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":91,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":92,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":93,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":96,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":110,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":111,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":112,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":113,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":114,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":115,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":116,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":117,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":118,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":119,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":120,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":123,"address":[],"length":0,"stats":{"Line":0},"fn_name":null}],"covered":0,"coverable":52},{"path":["/","home","core","prj","e3t","trifid","trifid-api","src","config.rs"],"content":"use serde::Deserialize;\nuse url::Url;\n\n#[derive(Deserialize)]\npub struct TFConfig {\n    pub listen_port: u16,\n    pub db_url: String,\n    pub base: Url,\n    pub web_root: Url,\n    pub magic_links_valid_for: i64,\n    pub session_tokens_valid_for: i64,\n    pub totp_verification_valid_for: i64,\n    pub data_key: String\n}","traces":[],"covered":0,"coverable":0},{"path":["/","home","core","prj","e3t","trifid","trifid-api","src","crypto.rs"],"content":"use std::error::Error;\nuse aes_gcm::{Aes256Gcm, KeyInit, Nonce};\nuse aes_gcm::aead::{Aead, Payload};\nuse crate::config::TFConfig;\n\npub fn get_cipher_from_config(config: \u0026TFConfig) -\u003e Result\u003cAes256Gcm, Box\u003cdyn Error\u003e\u003e {\n    let key_slice = hex::decode(\u0026config.data_key)?;\n    Ok(Aes256Gcm::new_from_slice(\u0026key_slice)?)\n}\n\npub fn encrypt_with_nonce(plaintext: \u0026[u8], nonce: [u8; 12], cipher: \u0026Aes256Gcm) -\u003e Result\u003cVec\u003cu8\u003e, aes_gcm::Error\u003e {\n    let nonce = Nonce::from_slice(\u0026nonce);\n    let ciphertext = cipher.encrypt(nonce, plaintext)?;\n    Ok(ciphertext)\n}\n\npub fn decrypt_with_nonce(ciphertext: \u0026[u8], nonce: [u8; 12], cipher: \u0026Aes256Gcm) -\u003e Result\u003cVec\u003cu8\u003e, aes_gcm::Error\u003e {\n    let nonce = Nonce::from_slice(\u0026nonce);\n    let plaintext = cipher.decrypt(nonce, Payload::from(ciphertext))?;\n    Ok(plaintext)\n}","traces":[],"covered":0,"coverable":0},{"path":["/","home","core","prj","e3t","trifid","trifid-api","src","db.rs"],"content":"","traces":[],"covered":0,"coverable":0},{"path":["/","home","core","prj","e3t","trifid","trifid-api","src","format.rs"],"content":"use std::fmt::{Display, Formatter};\nuse crate::format::PEMValidationError::{IncorrectSegmentLength, InvalidBase64Data, MissingStartSentinel};\nuse crate::util::base64decode;\n\npub const ED_PUBKEY_START_STR: \u0026str = \"-----BEGIN NEBULA ED25519 PUBLIC KEY-----\";\npub const ED_PUBKEY_END_STR: \u0026str = \"-----END NEBULA ED25519 PUBLIC KEY-----\";\n\npub const DH_PUBKEY_START_STR: \u0026str = \"-----BEGIN NEBULA X25519 PUBLIC KEY-----\";\npub const DH_PUBKEY_END_STR: \u0026str = \"-----END NEBULA X25519 PUBLIC KEY-----\";\n\npub enum PEMValidationError {\n    MissingStartSentinel,\n    InvalidBase64Data,\n    MissingEndSentinel,\n    IncorrectSegmentLength(usize, usize)\n}\nimpl Display for PEMValidationError {\n    fn fmt(\u0026self, f: \u0026mut Formatter\u003c'_\u003e) -\u003e std::fmt::Result {\n        match self {\n            Self::MissingEndSentinel =\u003e write!(f, \"Missing ending sentinel\"),\n            Self::MissingStartSentinel =\u003e write!(f, \"Missing starting sentinel\"),\n            Self::InvalidBase64Data =\u003e write!(f, \"invalid base64 data\"),\n            Self::IncorrectSegmentLength(expected, got) =\u003e write!(f, \"incorrect number of segments, expected {} got {}\", expected, got)\n        }\n    }\n}\n\npub fn validate_ed_pubkey_pem(pubkey: \u0026str) -\u003e Result\u003c(), PEMValidationError\u003e {\n    let segments = pubkey.split('\\n');\n    let segs = segments.collect::\u003cVec\u003c\u0026str\u003e\u003e();\n    if segs.len() \u003c 3 {\n        return Err(IncorrectSegmentLength(3, segs.len()))\n    }\n    if segs[0] != ED_PUBKEY_START_STR {\n        return Err(MissingStartSentinel)\n    }\n    if base64decode(segs[1]).is_err() {\n        return Err(InvalidBase64Data)\n    }\n    if segs[2] != ED_PUBKEY_END_STR {\n        return Err(MissingStartSentinel)\n    }\n    Ok(())\n}\n\npub fn validate_dh_pubkey_pem(pubkey: \u0026str) -\u003e Result\u003c(), PEMValidationError\u003e {\n    let segments = pubkey.split('\\n');\n    let segs = segments.collect::\u003cVec\u003c\u0026str\u003e\u003e();\n    if segs.len() \u003c 3 {\n        return Err(IncorrectSegmentLength(3, segs.len()))\n    }\n    if segs[0] != DH_PUBKEY_START_STR {\n        return Err(MissingStartSentinel)\n    }\n    if base64decode(segs[1]).is_err() {\n        return Err(InvalidBase64Data)\n    }\n    if segs[2] != DH_PUBKEY_END_STR {\n        return Err(MissingStartSentinel)\n    }\n    Ok(())\n}\n\npub fn validate_ed_pubkey_base64(pubkey: \u0026str) -\u003e Result\u003c(), PEMValidationError\u003e {\n    match base64decode(pubkey) {\n        Ok(k) =\u003e validate_ed_pubkey_pem(match std::str::from_utf8(k.as_ref()) {\n            Ok(k) =\u003e k,\n            Err(_) =\u003e return Err(InvalidBase64Data)\n        }),\n        Err(_) =\u003e Err(InvalidBase64Data)\n    }\n}\n\npub fn validate_dh_pubkey_base64(pubkey: \u0026str) -\u003e Result\u003c(), PEMValidationError\u003e {\n    match base64decode(pubkey) {\n        Ok(k) =\u003e validate_dh_pubkey_pem(match std::str::from_utf8(k.as_ref()) {\n            Ok(k) =\u003e k,\n            Err(_) =\u003e return Err(InvalidBase64Data)\n        }),\n        Err(_) =\u003e Err(InvalidBase64Data)\n    }\n}","traces":[],"covered":0,"coverable":0},{"path":["/","home","core","prj","e3t","trifid","trifid-api","src","main.rs"],"content":"extern crate core;\n\nuse std::error::Error;\nuse std::fs;\nuse std::path::Path;\nuse dotenvy::dotenv;\nuse log::{error, info};\nuse rocket::{catchers, Request, Response, routes};\nuse rocket::fairing::{Fairing, Info, Kind};\nuse rocket::http::Header;\nuse sqlx::migrate::Migrator;\nuse sqlx::postgres::PgPoolOptions;\nuse crate::config::TFConfig;\n\npub mod format;\npub mod util;\npub mod db;\npub mod config;\npub mod tokens;\npub mod routes;\npub mod auth;\npub mod crypto;\npub mod org;\n\nstatic MIGRATOR: Migrator = sqlx::migrate!();\n\npub struct CORS;\n\n#[rocket::async_trait]\nimpl Fairing for CORS {\n    fn info(\u0026self) -\u003e Info {\n        Info {\n            name: \"Add CORS headers to responses\",\n            kind: Kind::Response\n        }\n    }\n\n    async fn on_response\u003c'r\u003e(\u0026self, _request: \u0026'r Request\u003c'_\u003e, response: \u0026mut Response\u003c'r\u003e) {\n        response.set_header(Header::new(\"Access-Control-Allow-Origin\", \"*\"));\n        response.set_header(Header::new(\"Access-Control-Allow-Methods\", \"POST, GET, PATCH, OPTIONS\"));\n        response.set_header(Header::new(\"Access-Control-Allow-Headers\", \"*\"));\n        response.set_header(Header::new(\"Access-Control-Allow-Credentials\", \"true\"));\n    }\n}\n\n#[rocket::main]\nasync fn main() -\u003e Result\u003c(), Box\u003cdyn Error\u003e\u003e {\n    let _ = rocket::build();\n\n    info!(\"[tfapi] loading config\");\n\n    let _ = dotenv();\n\n    if std::env::var(\"CONFIG_FILE\").is_err() \u0026\u0026 !Path::new(\"config.toml\").exists() {\n        error!(\"[tfapi] fatal: the environment variable CONFIG_FILE is not set\");\n        error!(\"[tfapi]  help: try creating a .env file that sets it\");\n        error!(\"[tfapi]  help: or, create a file config.toml with your config, as it is loaded automatically\");\n        std::process::exit(1);\n    }\n\n    let config_file = if Path::new(\"config.toml\").exists() {\n        \"config.toml\".to_string()\n    } else {\n        std::env::var(\"CONFIG_FILE\").unwrap()\n    };\n\n    let config_data = match fs::read_to_string(\u0026config_file) {\n        Ok(d) =\u003e d,\n        Err(e) =\u003e {\n            error!(\"[tfapi] fatal: unable to read config from {}\", config_file);\n            error!(\"[tfapi] fatal: {}\", e);\n            std::process::exit(1);\n        }\n    };\n\n    let config: TFConfig = match toml::from_str(\u0026config_data) {\n        Ok(c) =\u003e c,\n        Err(e) =\u003e {\n            error!(\"[tfapi] fatal: unable to parse config from {}\", config_file);\n            error!(\"[tfapi] fatal: {}\", e);\n            std::process::exit(1);\n        }\n    };\n\n    info!(\"[tfapi] connecting to database pool\");\n\n    let pool = match PgPoolOptions::new().max_connections(5).connect(\u0026config.db_url).await {\n        Ok(p) =\u003e p,\n        Err(e) =\u003e {\n            error!(\"[tfapi] fatal: unable to connect to database pool\");\n            error!(\"[tfapi] fatal: {}\", e);\n            std::process::exit(1);\n        }\n    };\n\n    info!(\"[tfapi] running database migrations\");\n\n    MIGRATOR.run(\u0026pool).await?;\n\n    info!(\"[tfapi] building rocket config\");\n\n    let figment = rocket::Config::figment().merge((\"port\", config.listen_port));\n\n    let _ = rocket::custom(figment)\n        .mount(\"/\", routes![\n            crate::routes::v1::auth::magic_link::magiclink_request,\n            crate::routes::v1::auth::magic_link::options,\n            crate::routes::v1::signup::signup_request,\n            crate::routes::v1::signup::options,\n            crate::routes::v1::auth::verify_magic_link::verify_magic_link,\n            crate::routes::v1::auth::verify_magic_link::options,\n            crate::routes::v1::totp_authenticators::totp_authenticators_request,\n            crate::routes::v1::totp_authenticators::options,\n            crate::routes::v1::verify_totp_authenticator::verify_totp_authenticator_request,\n            crate::routes::v1::verify_totp_authenticator::options,\n            crate::routes::v1::auth::totp::totp_request,\n            crate::routes::v1::auth::totp::options,\n            crate::routes::v1::auth::check_session::check_session,\n            crate::routes::v1::auth::check_session::check_session_auth,\n            crate::routes::v1::auth::check_session::options,\n            crate::routes::v1::auth::check_session::options_auth,\n            crate::routes::v2::whoami::whoami_request,\n            crate::routes::v2::whoami::options,\n\n            crate::routes::v1::organization::options,\n            crate::routes::v1::organization::orgidoptions,\n            crate::routes::v1::organization::orginfo_req,\n            crate::routes::v1::organization::orglist_req,\n            crate::routes::v1::organization::create_org\n        ])\n        .register(\"/\", catchers![\n            crate::routes::handler_400,\n            crate::routes::handler_401,\n            crate::routes::handler_403,\n            crate::routes::handler_404,\n            crate::routes::handler_422,\n\n            crate::routes::handler_500,\n            crate::routes::handler_501,\n            crate::routes::handler_502,\n            crate::routes::handler_503,\n            crate::routes::handler_504,\n            crate::routes::handler_505,\n        ])\n        .attach(CORS)\n        .manage(pool)\n        .manage(config)\n        .launch().await?;\n\n    Ok(())\n}","traces":[{"line":38,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":39,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":40,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":41,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":42,"address":[],"length":0,"stats":{"Line":0},"fn_name":null}],"covered":0,"coverable":5},{"path":["/","home","core","prj","e3t","trifid","trifid-api","src","org.rs"],"content":"use std::error::Error;\nuse rocket::form::validate::Contains;\nuse sqlx::PgPool;\n\npub async fn get_org_by_owner_id(user: i32, db: \u0026PgPool) -\u003e Result\u003cOption\u003ci32\u003e, Box\u003cdyn Error\u003e\u003e {\n    Ok(match sqlx::query!(\"SELECT id FROM organizations WHERE owner = $1\", user).fetch_optional(db).await? {\n        Some(r) =\u003e Some(r.id),\n        None =\u003e None\n    })\n}\n\npub async fn get_orgs_by_assoc_id(user: i32, db: \u0026PgPool) -\u003e Result\u003cVec\u003ci32\u003e, Box\u003cdyn Error\u003e\u003e {\n    let res: Vec\u003c_\u003e = sqlx::query!(\"SELECT org_id FROM organization_authorized_users WHERE user_id = $1\", user).fetch_all(db).await?;\n\n    let mut ret = vec![];\n\n    for i in res {\n        ret.push(i.org_id);\n    }\n\n    Ok(ret)\n}\n\npub async fn get_users_by_assoc_org(org: i32, db: \u0026PgPool) -\u003e Result\u003cVec\u003ci32\u003e, Box\u003cdyn Error\u003e\u003e {\n    let res: Vec\u003c_\u003e = sqlx::query!(\"SELECT user_id FROM organization_authorized_users WHERE org_id = $1\", org).fetch_all(db).await?;\n\n    let mut ret = vec![];\n\n    for i in res {\n        ret.push(i.org_id);\n    }\n\n    Ok(ret)\n}\n\npub async fn get_associated_orgs(user: i32, db: \u0026PgPool) -\u003e Result\u003cVec\u003ci32\u003e, Box\u003cdyn Error\u003e\u003e {\n    let mut assoc_orgs = vec![];\n\n    if let Some(owned_org) = get_org_by_owner_id(user, db).await? {\n        assoc_orgs.push(owned_org);\n    }\n\n    assoc_orgs.append(\u0026mut get_orgs_by_assoc_id(user, db).await?);\n\n    Ok(assoc_orgs)\n}\n\npub async fn user_has_org_assoc(user: i32, org: i32, db: \u0026PgPool) -\u003e Result\u003cbool, Box\u003cdyn Error\u003e\u003e {\n    Ok(get_associated_orgs(user, db).await?.contains(org))\n}","traces":[],"covered":0,"coverable":0},{"path":["/","home","core","prj","e3t","trifid","trifid-api","src","routes","mod.rs"],"content":"pub mod v1;\npub mod v2;\n\nuse rocket::catch;\nuse serde::{Serialize};\nuse rocket::http::Status;\n\npub const ERR_MSG_MALFORMED_REQUEST: \u0026str = \"unable to parse the request body - is it valid JSON, using correct types?\";\npub const ERR_MSG_MALFORMED_REQUEST_CODE: \u0026str = \"ERR_MALFORMED_REQUEST\";\n\n/*\nTODO:\n    /v1/auth/magic-link                         [done]\n    /v1/auth/totp                               [done]\n    /v1/auth/verify-magic-link                  [done]\n    /v1/hosts/host-{id}/enrollment-code\n    /v1/hosts/host-{id}/enrollment-code-check\n    /v1/hosts/host-{id}\n    /v1/roles/role-{id}\n    /v1/feature-flags\n    /v1/hosts\n    /v1/networks\n    /v1/roles\n    /v1/signup                                  [done]\n    /v1/totp-authenticators                     [done]\n    /v1/verify-totp-authenticator               [done]\n    /v1/dnclient\n    /v2/enroll\n    /v2/whoami                                  [in-progress]\n */\n\n#[derive(Serialize)]\n#[serde(crate = \"rocket::serde\")]\npub struct APIError {\n    errors: Vec\u003cAPIErrorSingular\u003e\n}\n#[derive(Serialize)]\n#[serde(crate = \"rocket::serde\")]\npub struct APIErrorSingular {\n    code: String,\n    message: String\n}\n\nmacro_rules! error_handler {\n    ($code: expr, $err: expr, $msg: expr) =\u003e {\n        ::paste::paste! {\n            #[catch($code)]\n            pub fn [\u003chandler_ $code\u003e]() -\u003e (Status, String) {\n                (Status::from_code($code).unwrap(), format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{}\\\"}}]}}\", $err, $msg))\n            }\n        }\n    };\n}\nerror_handler!(400, \"ERR_MALFORMED_REQUEST\", \"unable to parse the request body, is it properly formatted?\");\nerror_handler!(401, \"ERR_AUTHENTICATION_REQUIRED\", \"this endpoint requires authentication but it was not provided\");\nerror_handler!(403, \"ERR_UNAUTHORIZED\", \"authorization was provided but it is expired or invalid\");\nerror_handler!(404, \"ERR_NOT_FOUND\", \"resource not found\");\nerror_handler!(405, \"ERR_METHOD_NOT_ALLOWED\", \"method not allowed for this endpoint\");\nerror_handler!(422, \"ERR_MALFORMED_REQUEST\", \"unable to parse the request body, is it properly formatted?\");\n\nerror_handler!(500, \"ERR_QL_QUERY_FAILED\", \"graphql query timed out\");\nerror_handler!(501, \"ERR_NOT_IMPLEMENTED\", \"query not supported by this version of graphql\");\nerror_handler!(502, \"ERR_PROXY_ERR\", \"servers under load, please try again later\");\nerror_handler!(503, \"ERR_SERVER_OVERLOADED\", \"servers under load, please try again later\");\nerror_handler!(504, \"ERR_PROXY_TIMEOUT\", \"servers under load, please try again later\");\nerror_handler!(505, \"ERR_CLIENT_UNSUPPORTED\", \"your version of dnclient is out of date, please update\");\n","traces":[],"covered":0,"coverable":0},{"path":["/","home","core","prj","e3t","trifid","trifid-api","src","routes","v1","auth","check_session.rs"],"content":"use rocket::{post, options};\nuse crate::auth::{PartialUserInfo, TOTPAuthenticatedUserInfo};\n\n#[options(\"/v1/auth/check_session\")]\npub async fn options() -\u003e \u0026'static str {\n    \"\"\n}\n\n#[post(\"/v1/auth/check_session\")]\npub async fn check_session(_user: PartialUserInfo) -\u003e \u0026'static str {\n    \"ok\"\n}\n\n#[options(\"/v1/auth/check_auth\")]\npub async fn options_auth() -\u003e \u0026'static str {\n    \"\"\n}\n\n\n#[post(\"/v1/auth/check_auth\")]\npub async fn check_session_auth(_user: TOTPAuthenticatedUserInfo) -\u003e \u0026'static str {\n    \"ok\"\n}","traces":[],"covered":0,"coverable":0},{"path":["/","home","core","prj","e3t","trifid","trifid-api","src","routes","v1","auth","magic_link.rs"],"content":"use rocket::{post, State};\nuse rocket::serde::json::Json;\nuse serde::{Serialize, Deserialize};\nuse rocket::http::{ContentType, Status};\nuse sqlx::PgPool;\nuse crate::config::TFConfig;\nuse crate::tokens::send_magic_link;\nuse rocket::options;\n\n#[derive(Serialize, Deserialize)]\n#[serde(crate = \"rocket::serde\")]\npub struct MagicLinkRequest {\n    pub email: String,\n}\n\n#[derive(Serialize, Deserialize)]\n#[serde(crate = \"rocket::serde\")]\npub struct MagicLinkResponseMetadata {}\n\n#[derive(Serialize, Deserialize)]\n#[serde(crate = \"rocket::serde\")]\npub struct MagicLinkResponse {\n    pub data: Option\u003cString\u003e,\n    pub metadata: MagicLinkResponseMetadata,\n}\n\n\n#[options(\"/v1/auth/magic-link\")]\npub async fn options() -\u003e \u0026'static str {\n    \"\"\n}\n\n#[post(\"/v1/auth/magic-link\", data = \"\u003creq\u003e\")]\npub async fn magiclink_request(req: Json\u003cMagicLinkRequest\u003e, pool: \u0026State\u003cPgPool\u003e, config: \u0026State\u003cTFConfig\u003e) -\u003e Result\u003c(ContentType, Json\u003cMagicLinkResponse\u003e), (Status, String)\u003e {\n    // figure out if the user already exists\n    let mut id = -1;\n    match sqlx::query!(\"SELECT id FROM users WHERE email = $1\", req.email.clone()).fetch_optional(pool.inner()).await {\n        Ok(res) =\u003e if let Some(r) = res { id = r.id as i64 },\n        Err(e) =\u003e {\n            return Err((Status::InternalServerError, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{} - {}\\\"}}]}}\", \"ERR_QL_QUERY_FAILED\", \"an error occurred while running the graphql query\", e)))\n        }\n    }\n\n    if id == -1 {\n        return Err((Status::Unauthorized, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{}\\\"}}]}}\", \"ERR_UNAUTHORIZED\", \"authorization was provided but it is expired or invalid\")))\n    }\n\n    // send magic link to email\n    match send_magic_link(id, req.email.clone(), pool.inner(), config.inner()).await {\n        Ok(_) =\u003e (),\n        Err(e) =\u003e {\n            return Err((Status::InternalServerError, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{} - {}\\\"}}]}}\", \"ERR_QL_QUERY_FAILED\", \"an error occurred while running the graphql query\", e)))\n        }\n    };\n\n    // this endpoint doesn't actually ever return an error? it will send you the magic link no matter what\n    // this appears to do the exact same thing as /v1/auth/magic-link, but it doesn't check if you have an account (magic-link does)\n    Ok((ContentType::JSON, Json(MagicLinkResponse {\n        data: None,\n        metadata: MagicLinkResponseMetadata {},\n    })))\n}","traces":[],"covered":0,"coverable":0},{"path":["/","home","core","prj","e3t","trifid","trifid-api","src","routes","v1","auth","mod.rs"],"content":"pub mod verify_magic_link;\npub mod magic_link;\npub mod totp;\npub mod check_session;","traces":[],"covered":0,"coverable":0},{"path":["/","home","core","prj","e3t","trifid","trifid-api","src","routes","v1","auth","totp.rs"],"content":"use rocket::http::{ContentType, Status};\nuse rocket::serde::json::Json;\nuse crate::auth::PartialUserInfo;\nuse serde::{Serialize, Deserialize};\nuse rocket::{post, State};\nuse sqlx::PgPool;\nuse rocket::options;\nuse crate::tokens::{generate_auth_token, get_totpmachine, user_has_totp};\n\npub const TOTP_GENERIC_UNAUTHORIZED_ERROR: \u0026str = \"{\\\"errors\\\":[{\\\"code\\\":\\\"ERR_INVALID_TOTP_CODE\\\",\\\"message\\\":\\\"invalid TOTP code (maybe it expired?)\\\",\\\"path\\\":\\\"code\\\"}]}\";\npub const TOTP_NO_TOTP_ERROR: \u0026str = \"{\\\"errors\\\":[{\\\"code\\\":\\\"ERR_NO_TOTP\\\",\\\"message\\\":\\\"logged-in user does not have totp enabled\\\",\\\"path\\\":\\\"code\\\"}]}\";\n\n#[derive(Serialize, Deserialize)]\n#[serde(crate = \"rocket::serde\")]\npub struct TotpRequest {\n    pub code: String\n}\n\n#[derive(Serialize, Deserialize)]\n#[serde(crate = \"rocket::serde\")]\npub struct TotpResponseData {\n    #[serde(rename = \"authToken\")]\n    auth_token: String\n}\n#[derive(Serialize, Deserialize)]\n#[serde(crate = \"rocket::serde\")]\npub struct TotpResponseMetadata {\n}\n#[derive(Serialize, Deserialize)]\n#[serde(crate = \"rocket::serde\")]\npub struct TotpResponse {\n    data: TotpResponseData,\n    metadata: TotpResponseMetadata\n}\n\n#[options(\"/v1/auth/totp\")]\npub async fn options() -\u003e \u0026'static str {\n    \"\"\n}\n\n\n#[post(\"/v1/auth/totp\", data = \"\u003creq\u003e\")]\npub async fn totp_request(req: Json\u003cTotpRequest\u003e, user: PartialUserInfo, db: \u0026State\u003cPgPool\u003e) -\u003e Result\u003c(ContentType, Json\u003cTotpResponse\u003e), (Status, String)\u003e {\n    if !match user_has_totp(user.user_id, db.inner()).await {\n        Ok(b) =\u003e b,\n        Err(e) =\u003e return Err((Status::InternalServerError, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{} - {}\\\"}}]}}\", \"ERR_UNABLE_TO_ISSUE\", \"an error occured trying to issue a session token, please try again later\", e)))\n    } {\n        return Err((Status::UnprocessableEntity, TOTP_NO_TOTP_ERROR.to_string()))\n    }\n\n    if user.has_totp_auth {\n        return Err((Status::BadRequest, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{}\\\"}}]}}\", \"ERR_TOTP_ALREADY_AUTHED\", \"user already has valid totp authentication\")))\n    }\n\n    let totpmachine = match get_totpmachine(user.user_id, db.inner()).await {\n        Ok(t) =\u003e t,\n        Err(e) =\u003e {\n            return Err((Status::InternalServerError, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{} - {}\\\"}}]}}\", \"ERR_UNABLE_TO_ISSUE\", \"an error occured trying to issue a session token, please try again later\", e)))\n        }\n    };\n\n    if !totpmachine.check_current(\u0026req.0.code).unwrap_or(false) {\n        return Err((Status::Unauthorized, TOTP_GENERIC_UNAUTHORIZED_ERROR.to_string()))\n    }\n\n    Ok((ContentType::JSON, Json(TotpResponse {\n        data: TotpResponseData { auth_token: match generate_auth_token(user.user_id as i64, user.session_id, db.inner()).await {\n            Ok(t) =\u003e t,\n            Err(e) =\u003e { return Err((Status::InternalServerError, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{} - {}\\\"}}]}}\", \"ERR_UNABLE_TO_ISSUE\", \"an error occured trying to issue a session token, please try again later\", e))) }\n        } },\n        metadata: TotpResponseMetadata {},\n    })))\n}","traces":[],"covered":0,"coverable":0},{"path":["/","home","core","prj","e3t","trifid","trifid-api","src","routes","v1","auth","verify_magic_link.rs"],"content":"use std::time::{SystemTime, UNIX_EPOCH};\nuse rocket::http::{ContentType, Status};\nuse rocket::serde::json::Json;\nuse serde::{Serialize, Deserialize};\nuse rocket::{post, State};\nuse sqlx::PgPool;\nuse crate::config::TFConfig;\nuse crate::tokens::generate_session_token;\nuse rocket::options;\n\n#[derive(Serialize, Deserialize)]\n#[serde(crate = \"rocket::serde\")]\npub struct VerifyMagicLinkRequest {\n    #[serde(rename = \"magicLinkToken\")]\n    pub magic_link_token: String,\n}\n\n\n#[derive(Serialize, Deserialize)]\npub struct VerifyMagicLinkResponseMetadata {}\n\n#[derive(Serialize, Deserialize)]\npub struct VerifyMagicLinkResponseData {\n    #[serde(rename = \"sessionToken\")]\n    pub session_token: String,\n}\n\n#[derive(Serialize, Deserialize)]\npub struct VerifyMagicLinkResponse {\n    pub data: VerifyMagicLinkResponseData,\n    pub metadata: VerifyMagicLinkResponseMetadata,\n}\n\n#[options(\"/v1/auth/verify-magic-link\")]\npub async fn options() -\u003e \u0026'static str {\n    \"\"\n}\n\n\n#[post(\"/v1/auth/verify-magic-link\", data = \"\u003creq\u003e\")]\npub async fn verify_magic_link(req: Json\u003cVerifyMagicLinkRequest\u003e, db: \u0026State\u003cPgPool\u003e, config: \u0026State\u003cTFConfig\u003e) -\u003e Result\u003c(ContentType, Json\u003cVerifyMagicLinkResponse\u003e), (Status, String)\u003e {\n    // get the current time to check if the token is expired\n    let (user_id, expired_at) = match sqlx::query!(\"SELECT user_id, expires_on FROM magic_links WHERE id = $1\", req.0.magic_link_token).fetch_one(db.inner()).await {\n        Ok(row) =\u003e (row.user_id, row.expires_on),\n        Err(e) =\u003e {\n            return Err((Status::Unauthorized, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{} - {}\\\"}}]}}\", \"ERR_UNAUTHORIZED\", \"this token is invalid\", e)))\n        }\n    };\n    let current_time = SystemTime::now().duration_since(UNIX_EPOCH).unwrap().as_secs() as i32;\n    println!(\"expired on {}, currently {}\", expired_at, current_time);\n    if expired_at \u003c current_time {\n        return Err((Status::Unauthorized, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{}\\\"}}]}}\", \"ERR_UNAUTHORIZED\", \"valid authorization was provided but it is expired\")))\n    }\n\n    // generate session token\n    let token = match generate_session_token(user_id as i64, db.inner(), config.inner()).await {\n        Ok(t) =\u003e t,\n        Err(e) =\u003e {\n            return Err((Status::InternalServerError, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{} - {}\\\"}}]}}\", \"ERR_UNABLE_TO_ISSUE\", \"an error occured trying to issue a session token, please try again later\", e)))\n        }\n    };\n\n    // delete the token\n    match sqlx::query!(\"DELETE FROM magic_links WHERE id = $1\", req.0.magic_link_token).execute(db.inner()).await {\n        Ok(_) =\u003e (),\n        Err(e) =\u003e {\n            return Err((Status::InternalServerError, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{} - {}\\\"}}]}}\", \"ERR_UNABLE_TO_ISSUE\", \"an error occured trying to issue a session token, please try again later\", e)))\n        }\n    }\n\n    Ok((ContentType::JSON, Json(VerifyMagicLinkResponse {\n        data: VerifyMagicLinkResponseData { session_token: token },\n        metadata: VerifyMagicLinkResponseMetadata {},\n    })))\n}","traces":[],"covered":0,"coverable":0},{"path":["/","home","core","prj","e3t","trifid","trifid-api","src","routes","v1","mod.rs"],"content":"pub mod auth;\npub mod signup;\n\npub mod totp_authenticators;\npub mod verify_totp_authenticator;\npub mod organization;","traces":[],"covered":0,"coverable":0},{"path":["/","home","core","prj","e3t","trifid","trifid-api","src","routes","v1","organization.rs"],"content":"use std::slice::from_raw_parts_mut;\nuse rocket::{get, post, options, State};\nuse rocket::http::{ContentType, Status};\nuse rocket::serde::json::Json;\nuse serde::{Serialize, Deserialize};\nuse sqlx::PgPool;\nuse crate::auth::TOTPAuthenticatedUserInfo;\nuse crate::config::TFConfig;\nuse crate::org::{get_associated_orgs, get_org_by_owner_id, get_users_by_assoc_org, user_has_org_assoc};\n\n#[options(\"/v1/orgs\")]\npub fn options() -\u003e \u0026'static str {\n    \"\"\n}\n#[options(\"/v1/org/\u003c_id\u003e\")]\npub fn orgidoptions(_id: i32) -\u003e \u0026'static str {\n    \"\"\n}\n\n#[derive(Serialize, Deserialize)]\n#[serde(crate = \"rocket::serde\")]\npub struct OrglistStruct {\n    pub org_ids: Vec\u003ci32\u003e\n}\n\n\n#[get(\"/v1/orgs\")]\npub async fn orglist_req(user: TOTPAuthenticatedUserInfo, db: \u0026State\u003cPgPool\u003e) -\u003e Result\u003c(ContentType, Json\u003cOrglistStruct\u003e), (Status, String)\u003e {\n    // this endpoint lists the associated organizations this user has access to\n    let associated_orgs = match get_associated_orgs(user.user_id, db.inner()).await {\n        Ok(r) =\u003e r,\n        Err(e) =\u003e return Err((Status::InternalServerError, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{} - {}\\\"}}]}}\", \"ERR_DB_QUERY_FAILED\", \"an error occurred while running the database query\")))\n    };\n\n    Ok((ContentType::JSON, Json(OrglistStruct {\n        org_ids: associated_orgs\n    })))\n}\n\n#[derive(Serialize, Deserialize)]\n#[serde(crate = \"rocket::serde\")]\npub struct OrginfoStruct {\n    pub org_id: i32,\n    pub owner_id: i32,\n    pub ca_crt: String,\n    pub authorized_users: Vec\u003ci32\u003e\n}\n\n#[get(\"/v1/org/\u003corgid\u003e\")]\npub async fn orginfo_req(orgid: i32, user: TOTPAuthenticatedUserInfo, db: \u0026State\u003cPgPool\u003e) -\u003e Result\u003c(ContentType, Json\u003cOrginfoStruct\u003e), (Status, String)\u003e {\n    if !user_has_org_assoc(orgid, user.user_id, db.inner()).await.map_err(|e| (Status::InternalServerError, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{} - {}\\\"}}]}}\", \"ERR_QL_QUERY_FAILED\", \"an error occurred while running the graphql query\", e)))? {\n        return Err((Status::Unauthorized, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{}\\\"}}]}}\", \"ERR_MISSING_ORG_AUTHORIZATION\", \"this user does not have permission to access this org\")));\n    }\n\n    let org = sqlx::query!(\"SELECT id, owner, ca_crt FROM organizations WHERE id = $1\", orgid).fetch_one(orgid).await.map_err(|e| (Status::InternalServerError, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{} - {}\\\"}}]}}\", \"ERR_QL_QUERY_FAILED\", \"an error occurred while running the graphql query\", e)))?;\n    let authorized_users = get_users_by_assoc_org(orgid, db.inner()).await.map_err(|e| (Status::InternalServerError, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{} - {}\\\"}}]}}\", \"ERR_QL_QUERY_FAILED\", \"an error occurred while running the graphql query\", e)))?;\n\n    Ok((ContentType::JSON, Json(\n        OrginfoStruct {\n            org_id: orgid,\n            owner_id: org.owner,\n            ca_crt: org.ca_crt,\n            authorized_users,\n        }\n    )))\n}\n\n#[post(\"/v1/org\")]\npub async fn create_org(user: TOTPAuthenticatedUserInfo, db: \u0026State\u003cPgPool\u003e, config: \u0026State\u003cTFConfig\u003e) -\u003e Result\u003c(ContentType, Json\u003cOrginfoStruct\u003e), (Status, String)\u003e {\n    if get_org_by_owner_id(user.user_id, db.inner()).await.map_err(|e| (Status::InternalServerError, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{} - {}\\\"}}]}}\", \"ERR_QL_QUERY_FAILED\", \"an error occurred while running the graphql query\", e)))?.is_some() {\n        return Err((Status::Conflict, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{}\\\"}}]}}\", \"ERR_USER_OWNS_ORG\", \"a user can only own one organization at a time\")))\n    }\n\n    // we need to generate a keypair and CA certificate for this new org\n\n    Ok((ContentType::JSON, Json(\n        OrginfoStruct {\n            org_id: orgid,\n            owner_id: org.owner,\n            ca_crt: org.ca_crt,\n            authorized_users,\n        }\n    )))\n}","traces":[],"covered":0,"coverable":0},{"path":["/","home","core","prj","e3t","trifid","trifid-api","src","routes","v1","signup.rs"],"content":"use rocket::{post, State};\nuse rocket::serde::json::Json;\nuse serde::{Serialize, Deserialize};\nuse std::time::{SystemTime, UNIX_EPOCH};\nuse rocket::http::{ContentType, Status};\nuse sqlx::PgPool;\nuse crate::config::TFConfig;\nuse crate::tokens::send_magic_link;\nuse rocket::options;\n\n#[derive(Serialize, Deserialize)]\n#[serde(crate = \"rocket::serde\")]\npub struct SignupRequest {\n    pub email: String,\n}\n\n#[derive(Serialize, Deserialize)]\n#[serde(crate = \"rocket::serde\")]\npub struct SignupResponseMetadata {}\n\n#[derive(Serialize, Deserialize)]\n#[serde(crate = \"rocket::serde\")]\npub struct SignupResponse {\n    pub data: Option\u003cString\u003e,\n    pub metadata: SignupResponseMetadata,\n}\n/*\ncreated_on TIMESTAMP NOT NULL,\n\n    banned INTEGER NOT NULL,\n    ban_reason VARCHAR(1024) NOT NULL\n */\n#[options(\"/v1/signup\")]\npub async fn options() -\u003e \u0026'static str {\n    \"\"\n}\n\n#[post(\"/v1/signup\", data = \"\u003creq\u003e\")]\npub async fn signup_request(req: Json\u003cSignupRequest\u003e, pool: \u0026State\u003cPgPool\u003e, config: \u0026State\u003cTFConfig\u003e) -\u003e Result\u003c(ContentType, Json\u003cSignupResponse\u003e), (Status, String)\u003e {\n    // figure out if the user already exists\n    let mut id = -1;\n    match sqlx::query!(\"SELECT id FROM users WHERE email = $1\", req.email.clone()).fetch_optional(pool.inner()).await {\n        Ok(res) =\u003e if let Some(r) = res { id = r.id as i64 },\n        Err(e) =\u003e {\n            return Err((Status::InternalServerError, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{} - {}\\\"}}]}}\", \"ERR_QL_QUERY_FAILED\", \"an error occurred while running the graphql query\", e)))\n        }\n    }\n\n    if id == -1 {\n        let id_res = match sqlx::query!(\"INSERT INTO users (email, created_on, banned, ban_reason, totp_secret, totp_otpurl, totp_verified) VALUES ($1, $2, $3, $4, $5, $6, $7) ON CONFLICT DO NOTHING RETURNING id;\", req.email, SystemTime::now().duration_since(UNIX_EPOCH).unwrap().as_secs() as i64, 0, \"\", \"\", \"\", 0).fetch_one(pool.inner()).await {\n            Ok(row) =\u003e row.id,\n            Err(e) =\u003e {\n                return Err((Status::InternalServerError, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{} - {}\\\"}}]}}\", \"ERR_QL_QUERY_FAILED\", \"an error occurred while running the graphql query\", e)))\n            }\n        };\n        id = id_res as i64;\n    }\n\n    // send magic link to email\n    match send_magic_link(id, req.email.clone(), pool.inner(), config.inner()).await {\n        Ok(_) =\u003e (),\n        Err(e) =\u003e {\n            return Err((Status::InternalServerError, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{} - {}\\\"}}]}}\", \"ERR_QL_QUERY_FAILED\", \"an error occurred while running the graphql query\", e)))\n        }\n    };\n\n    // this endpoint doesn't actually ever return an error? it will send you the magic link no matter what\n    // this appears to do the exact same thing as /v1/auth/magic-link, but it doesn't check if you have an account (magic-link does)\n    Ok((ContentType::JSON, Json(SignupResponse {\n        data: None,\n        metadata: SignupResponseMetadata {},\n    })))\n}","traces":[],"covered":0,"coverable":0},{"path":["/","home","core","prj","e3t","trifid","trifid-api","src","routes","v1","totp_authenticators.rs"],"content":"use rocket::http::{ContentType, Status};\nuse rocket::serde::json::Json;\nuse rocket::{State, post};\nuse sqlx::PgPool;\nuse serde::{Serialize, Deserialize};\nuse crate::auth::PartialUserInfo;\nuse crate::config::TFConfig;\nuse crate::tokens::{create_totp_token, user_has_totp};\nuse rocket::options;\n\n#[derive(Deserialize)]\npub struct TotpAuthenticatorsRequest {}\n#[derive(Serialize, Deserialize)]\n#[serde(crate = \"rocket::serde\")]\npub struct TotpAuthenticatorsResponseMetadata {}\n#[derive(Serialize, Deserialize)]\n#[serde(crate = \"rocket::serde\")]\npub struct TotpAuthenticatorsResponseData {\n    #[serde(rename = \"totpToken\")]\n    pub totp_token: String,\n    pub secret: String,\n    pub url: String,\n}\n#[derive(Serialize, Deserialize)]\n#[serde(crate = \"rocket::serde\")]\npub struct TotpAuthenticatorsResponse {\n    pub data: TotpAuthenticatorsResponseData,\n    pub metadata: TotpAuthenticatorsResponseMetadata,\n}\n\n#[options(\"/v1/totp-authenticators\")]\npub async fn options() -\u003e \u0026'static str {\n    \"\"\n}\n\n\n#[post(\"/v1/totp-authenticators\", data = \"\u003c_req\u003e\")]\npub async fn totp_authenticators_request(_req: Json\u003cTotpAuthenticatorsRequest\u003e, user: PartialUserInfo, db: \u0026State\u003cPgPool\u003e, config: \u0026State\u003cTFConfig\u003e) -\u003e Result\u003c(ContentType, Json\u003cTotpAuthenticatorsResponse\u003e), (Status, String)\u003e {\n    if match user_has_totp(user.user_id, db.inner()).await {\n        Ok(b) =\u003e b,\n        Err(e) =\u003e return Err((Status::InternalServerError, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{} - {}\\\"}}]}}\", \"ERR_UNABLE_TO_ISSUE\", \"an error occured trying to issue a session token, please try again later\", e)))\n    } {\n        return Err((Status::BadRequest, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{}\\\"}}]}}\", \"ERR_TOTP_ALREADY_EXISTS\", \"this user already has a totp authenticator on their account\")))\n    }\n\n    // generate a totp token\n    let (totptoken, totpmachine) = match create_totp_token(user.email, db.inner(), config.inner()).await {\n        Ok(t) =\u003e t,\n        Err(e) =\u003e return Err((Status::InternalServerError, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{} - {}\\\"}}]}}\", \"ERR_UNABLE_TO_ISSUE\", \"an error occured issuing a totp token, try again later\", e)))\n    };\n\n    Ok((ContentType::JSON, Json(TotpAuthenticatorsResponse {\n        data: TotpAuthenticatorsResponseData {\n            totp_token: totptoken,\n            secret: totpmachine.get_secret_base32(),\n            url: totpmachine.get_url(),\n        },\n        metadata: TotpAuthenticatorsResponseMetadata {},\n    })))\n}","traces":[],"covered":0,"coverable":0},{"path":["/","home","core","prj","e3t","trifid","trifid-api","src","routes","v1","verify_totp_authenticator.rs"],"content":"/*\n{\"totpToken\":\"totp-mH9eLzA9Q5WB-sg3Fq8CfkP13eTh3DxF25kVK2VEDOk\",\"code\":\"266242\"}\n{\"errors\":[{\"code\":\"ERR_INVALID_TOTP_TOKEN\",\"message\":\"TOTP token does not exist (maybe it expired?)\",\"path\":\"totpToken\"}]}\n\n\n{\"totpToken\":\"totp-gaUDaxPrrIBc8GEQ6z0vPisT8k0MEP1fgI8FA2ztLMw\",\"code\":\"175543\"}\n{\"data\":{\"authToken\":\"auth-O7mugxdYta-RKtLMqDW4j8XCJ85EfZKKezeZZXBYtFQ\"},\"metadata\":{}}\n*/\n\nuse rocket::http::{ContentType, Status};\nuse crate::auth::PartialUserInfo;\nuse rocket::post;\nuse rocket::serde::json::Json;\nuse rocket::State;\nuse serde::{Serialize, Deserialize};\nuse sqlx::PgPool;\nuse crate::tokens::{generate_auth_token, use_totp_token, verify_totp_token};\nuse rocket::options;\n\n#[derive(Serialize, Deserialize)]\npub struct VerifyTotpAuthenticatorRequest {\n    #[serde(rename = \"totpToken\")]\n    pub totp_token: String,\n    pub code: String,\n}\n\n#[derive(Serialize, Deserialize)]\npub struct VerifyTotpAuthenticatorResponseMetadata {}\n\n#[derive(Serialize, Deserialize)]\npub struct VerifyTotpAuthenticatorResponseData {\n    #[serde(rename = \"authToken\")]\n    pub auth_token: String,\n}\n\n#[derive(Serialize, Deserialize)]\npub struct VerifyTotpAuthenticatorResponse {\n    pub data: VerifyTotpAuthenticatorResponseData,\n    pub metadata: VerifyTotpAuthenticatorResponseMetadata,\n}\n\n#[options(\"/v1/verify-totp-authenticator\")]\npub async fn options() -\u003e \u0026'static str {\n    \"\"\n}\n\n\n#[post(\"/v1/verify-totp-authenticator\", data = \"\u003creq\u003e\")]\npub async fn verify_totp_authenticator_request(req: Json\u003cVerifyTotpAuthenticatorRequest\u003e, db: \u0026State\u003cPgPool\u003e, user: PartialUserInfo) -\u003e Result\u003c(ContentType, Json\u003cVerifyTotpAuthenticatorResponse\u003e), (Status, String)\u003e {\n    let totpmachine = match verify_totp_token(req.0.totp_token.clone(), user.email.clone(), db.inner()).await {\n        Ok(t) =\u003e t,\n        Err(e) =\u003e return Err((Status::Unauthorized, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{} - {}\\\"}}]}}\", \"ERR_UNAUTHORIZED\", \"this token is invalid\", e)))\n    };\n    if !totpmachine.check_current(\u0026req.0.code).unwrap() {\n        return Err((Status::Unauthorized, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{}\\\",\\\"path\\\":\\\"totpToken\\\"}}]}}\", \"ERR_INVALID_TOTP_CODE\", \"Invalid TOTP code\")))\n    }\n    match use_totp_token(req.0.totp_token, user.email, db.inner()).await {\n        Ok(_) =\u003e (),\n        Err(e) =\u003e return Err((Status::InternalServerError, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{} - {}\\\"}}]}}\", \"ERR_UNABLE_TO_ISSUE\", \"an error occured trying to issue a session token, please try again later\", e)))\n    }\n    Ok((ContentType::JSON, Json(VerifyTotpAuthenticatorResponse {\n        data: VerifyTotpAuthenticatorResponseData { auth_token: match generate_auth_token(user.user_id as i64, user.session_id, db.inner()).await {\n            Ok(at) =\u003e at,\n            Err(e) =\u003e return Err((Status::InternalServerError, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{} - {}\\\"}}]}}\", \"ERR_UNABLE_TO_ISSUE\", \"an error occured trying to issue a session token, please try again later\", e)))\n        } },\n        metadata: VerifyTotpAuthenticatorResponseMetadata {},\n    })))\n}","traces":[],"covered":0,"coverable":0},{"path":["/","home","core","prj","e3t","trifid","trifid-api","src","routes","v2","mod.rs"],"content":"pub mod whoami;","traces":[],"covered":0,"coverable":0},{"path":["/","home","core","prj","e3t","trifid","trifid-api","src","routes","v2","whoami.rs"],"content":"use chrono::{NaiveDateTime, Utc};\nuse serde::{Serialize, Deserialize};\nuse rocket::{options, get, State};\nuse rocket::http::{ContentType, Status};\nuse rocket::serde::json::Json;\nuse sqlx::PgPool;\nuse crate::auth::PartialUserInfo;\nuse crate::tokens::user_has_totp;\n\n#[derive(Serialize, Deserialize)]\npub struct WhoamiMetadata {}\n\n#[derive(Serialize, Deserialize)]\npub struct WhoamiActor {\n    pub id: String,\n    #[serde(rename = \"organizationID\")]\n    pub organization_id: String,\n    pub email: String,\n    #[serde(rename = \"createdAt\")]\n    pub created_at: String,\n    #[serde(rename = \"hasTOTPAuthenticator\")]\n    pub has_totpauthenticator: bool,\n}\n\n#[derive(Serialize, Deserialize)]\npub struct WhoamiData {\n    #[serde(rename = \"actorType\")]\n    pub actor_type: String,\n    pub actor: WhoamiActor,\n}\n\n#[derive(Serialize, Deserialize)]\npub struct WhoamiResponse {\n    pub data: WhoamiData,\n    pub metadata: WhoamiMetadata,\n}\n\n#[options(\"/v2/whoami\")]\npub fn options() -\u003e \u0026'static str {\n    \"\"\n}\n\n#[get(\"/v2/whoami\")]\npub async fn whoami_request(user: PartialUserInfo, db: \u0026State\u003cPgPool\u003e) -\u003e Result\u003c(ContentType, Json\u003cWhoamiResponse\u003e), (Status, String)\u003e {\n    Ok((ContentType::JSON, Json(WhoamiResponse {\n        data: WhoamiData {\n            actor_type: \"user\".to_string(),\n            actor: WhoamiActor {\n                id: user.user_id.to_string(),\n                organization_id: \"TEMP_ORG_BECAUSE_THAT_ISNT_IMPLEMENTED_YET\".to_string(),\n                email: user.email,\n                created_at: NaiveDateTime::from_timestamp_opt(user.created_at, 0).unwrap().and_local_timezone(Utc).unwrap().to_rfc3339(),\n                has_totpauthenticator: match user_has_totp(user.user_id, db.inner()).await {\n                    Ok(b) =\u003e b,\n                    Err(e) =\u003e return Err((Status::InternalServerError, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{} - {}\\\"}}]}}\", \"ERR_DBERROR\", \"an error occured trying to verify your user\", e)))\n                },\n            }\n        },\n        metadata: WhoamiMetadata {},\n    })))\n}","traces":[],"covered":0,"coverable":0},{"path":["/","home","core","prj","e3t","trifid","trifid-api","src","tokens.rs"],"content":"use std::error::Error;\nuse log::info;\nuse sqlx::PgPool;\nuse uuid::Uuid;\nuse crate::config::TFConfig;\nuse std::time::SystemTime;\nuse std::time::UNIX_EPOCH;\nuse totp_rs::{Secret, TOTP};\nuse crate::util::{TOTP_ALGORITHM, TOTP_DIGITS, TOTP_ISSUER, TOTP_SKEW, TOTP_STEP};\n\n// https://admin.defined.net/auth/magic-link?email=coredoescode%40gmail.com\u0026token=ml-ckBsgw_5IdK5VYgseBYcoV_v_cQjtdq1re_RhDu_MKg\npub async fn send_magic_link(id: i64, email: String, db: \u0026PgPool, config: \u0026TFConfig) -\u003e Result\u003c(), Box\u003cdyn Error\u003e\u003e {\n    let otp = format!(\"ml-{}\", Uuid::new_v4());\n    let otp_url = config.web_root.join(\u0026format!(\"/auth/magic-link?email={}\u0026token={}\", urlencoding::encode(\u0026email.clone()), otp.clone())).unwrap();\n    sqlx::query!(\"INSERT INTO magic_links (id, user_id, expires_on) VALUES ($1, $2, $3) ON CONFLICT DO NOTHING;\", otp, id as i32, SystemTime::now().duration_since(UNIX_EPOCH).unwrap().as_secs() as i32 + config.magic_links_valid_for as i32).execute(db).await?;\n    // TODO: send email\n    info!(\"sent magic link {} to {}, valid for {} seconds\", otp_url, email.clone(), config.magic_links_valid_for);\n    Ok(())\n}\n\npub async fn generate_session_token(user_id: i64, db: \u0026PgPool, config: \u0026TFConfig) -\u003e Result\u003cString, Box\u003cdyn Error\u003e\u003e {\n    let token = format!(\"st-{}\", Uuid::new_v4());\n    sqlx::query!(\"INSERT INTO session_tokens (id, user_id, expires_on) VALUES ($1, $2, $3) ON CONFLICT DO NOTHING;\", token, user_id as i32, SystemTime::now().duration_since(UNIX_EPOCH).unwrap().as_secs() as i32 + config.session_tokens_valid_for as i32).execute(db).await?;\n    Ok(token)\n}\npub async fn validate_session_token(token: String, db: \u0026PgPool) -\u003e Result\u003ci64, Box\u003cdyn Error\u003e\u003e {\n    Ok(sqlx::query!(\"SELECT user_id FROM session_tokens WHERE id = $1 AND expires_on \u003e $2\", token, SystemTime::now().duration_since(UNIX_EPOCH).unwrap().as_secs() as i32).fetch_one(db).await?.user_id as i64)\n}\n\npub async fn generate_auth_token(user_id: i64, session_id: String, db: \u0026PgPool) -\u003e Result\u003cString, Box\u003cdyn Error\u003e\u003e {\n    let token = format!(\"at-{}\", Uuid::new_v4());\n    sqlx::query!(\"INSERT INTO auth_tokens (id, session_token, user_id) VALUES ($1, $2, $3) ON CONFLICT DO NOTHING;\", token, session_id, user_id as i32).execute(db).await?;\n    Ok(token)\n}\npub async fn validate_auth_token(token: String, session_id: String, db: \u0026PgPool) -\u003e Result\u003c(), Box\u003cdyn Error\u003e\u003e {\n    validate_session_token(session_id.clone(), db).await?;\n    sqlx::query!(\"SELECT * FROM auth_tokens WHERE id = $1 AND session_token = $2\", token, session_id).fetch_one(db).await?;\n    Ok(())\n}\n\n\n/*\nCREATE TABLE totp_create_tokens (\n    id VARCHAR(39) NOT NULL PRIMARY KEY,\n    expires_on INTEGER NOT NULL,\n    totp_otpurl VARCHAR(3000) NOT NULL,\n    totp_secret VARCHAR(128) NOT NULL\n);\n */\n\npub async fn create_totp_token(email: String, db: \u0026PgPool, config: \u0026TFConfig) -\u003e Result\u003c(String, TOTP), Box\u003cdyn Error\u003e\u003e {\n    // create the TOTP parameters\n\n    let secret = Secret::generate_secret();\n    let totpmachine = TOTP::new(TOTP_ALGORITHM, TOTP_DIGITS, TOTP_SKEW, TOTP_STEP, secret.to_bytes().unwrap(), Some(TOTP_ISSUER.to_string()), email).unwrap();\n    let otpurl = totpmachine.get_url();\n    let otpsecret = totpmachine.get_secret_base32();\n\n    let otpid = format!(\"totp-{}\", Uuid::new_v4());\n\n    sqlx::query!(\"INSERT INTO totp_create_tokens (id, expires_on, totp_otpurl, totp_secret) VALUES ($1, $2, $3, $4);\", otpid.clone(), (SystemTime::now().duration_since(UNIX_EPOCH).unwrap().as_secs() as i64 + config.totp_verification_valid_for) as i32, otpurl, otpsecret).execute(db).await?;\n\n    Ok((otpid, totpmachine))\n}\n\npub async fn verify_totp_token(otpid: String, email: String, db: \u0026PgPool) -\u003e Result\u003cTOTP, Box\u003cdyn Error\u003e\u003e {\n    let totprow = sqlx::query!(\"SELECT * FROM totp_create_tokens WHERE id = $1 AND expires_on \u003e $2\", otpid, SystemTime::now().duration_since(UNIX_EPOCH).unwrap().as_secs() as i32).fetch_one(db).await?;\n    let secret = Secret::Encoded(totprow.totp_secret);\n    let totpmachine = TOTP::new(TOTP_ALGORITHM, TOTP_DIGITS, TOTP_SKEW, TOTP_STEP, secret.to_bytes().unwrap(), Some(TOTP_ISSUER.to_string()), email).unwrap();\n\n    if totpmachine.get_url() != totprow.totp_otpurl {\n        return Err(\"OTPURLs do not match (email does not match?)\".into())\n    }\n\n    Ok(totpmachine)\n}\n\npub async fn use_totp_token(otpid: String, email: String, db: \u0026PgPool) -\u003e Result\u003cTOTP, Box\u003cdyn Error\u003e\u003e {\n    let totpmachine = verify_totp_token(otpid.clone(), email.clone(), db).await?;\n    sqlx::query!(\"DELETE FROM totp_create_tokens WHERE id = $1\", otpid).execute(db).await?;\n    sqlx::query!(\"UPDATE users SET totp_otpurl = $1, totp_secret = $2, totp_verified = 1 WHERE email = $3\", totpmachine.get_url(), totpmachine.get_secret_base32(), email).execute(db).await?;\n    Ok(totpmachine)\n}\n\npub async fn get_totpmachine(user: i32, db: \u0026PgPool) -\u003e Result\u003cTOTP, Box\u003cdyn Error\u003e\u003e {\n    let user = sqlx::query!(\"SELECT totp_secret, totp_otpurl, email FROM users WHERE id = $1\", user).fetch_one(db).await?;\n    let secret = Secret::Encoded(user.totp_secret);\n    Ok(TOTP::new(TOTP_ALGORITHM, TOTP_DIGITS, TOTP_SKEW, TOTP_STEP, secret.to_bytes().unwrap(), Some(TOTP_ISSUER.to_string()), user.email).unwrap())\n}\n\npub async fn user_has_totp(user: i32, db: \u0026PgPool) -\u003e Result\u003cbool, Box\u003cdyn Error\u003e\u003e {\n    Ok(sqlx::query!(\"SELECT totp_verified FROM users WHERE id = $1\", user).fetch_one(db).await?.totp_verified == 1)\n}","traces":[],"covered":0,"coverable":0},{"path":["/","home","core","prj","e3t","trifid","trifid-api","src","util.rs"],"content":"use base64::Engine;\nuse totp_rs::Algorithm;\n\npub const TOTP_ALGORITHM: Algorithm = Algorithm::SHA1;\npub const TOTP_DIGITS: usize = 6;\npub const TOTP_SKEW: u8 = 1;\npub const TOTP_STEP: u64 = 30;\npub const TOTP_ISSUER: \u0026str = \"trifidapi\";\n\npub fn base64decode(val: \u0026str) -\u003e Result\u003cVec\u003cu8\u003e, base64::DecodeError\u003e {\n    base64::engine::general_purpose::STANDARD.decode(val)\n}\npub fn base64encode(val: Vec\u003cu8\u003e) -\u003e String {\n    base64::engine::general_purpose::STANDARD.encode(val)\n}","traces":[],"covered":0,"coverable":0},{"path":["/","home","core","prj","e3t","trifid","trifid-pki","src","ca.rs"],"content":"//! Structs to represent a pool of CA's and blacklisted certificates\n\nuse std::collections::HashMap;\nuse std::error::Error;\nuse std::fmt::{Display, Formatter};\nuse std::time::SystemTime;\nuse ed25519_dalek::VerifyingKey;\nuse crate::cert::{deserialize_nebula_certificate_from_pem, NebulaCertificate};\n\n/// A pool of trusted CA certificates, and certificates that should be blocked.\n/// This is equivalent to the `pki` section in a typical Nebula config.yml.\n#[derive(Default)]\npub struct NebulaCAPool {\n    /// The list of CA root certificates that should be trusted.\n    pub cas: HashMap\u003cString, NebulaCertificate\u003e,\n    /// The list of blocklisted certificate fingerprints\n    pub cert_blocklist: Vec\u003cString\u003e,\n    /// True if any of the member CAs certificates are expired. Must be handled.\n    pub expired: bool\n}\n\nimpl NebulaCAPool {\n    /// Create a new, blank CA pool\n    pub fn new() -\u003e Self {\n        Self::default()\n    }\n\n    /// Create a new CA pool from a set of PEM encoded CA certificates.\n    /// If any of the certificates are expired, the pool will **still be returned**, with the expired flag set.\n    /// This must be handled properly.\n    /// # Errors\n    /// This function will return an error if PEM data provided was invalid.\n    pub fn new_from_pem(bytes: \u0026[u8]) -\u003e Result\u003cSelf, Box\u003cdyn Error\u003e\u003e {\n        let pems = pem::parse_many(bytes)?;\n\n        let mut pool = Self::new();\n\n        for cert in pems {\n            match pool.add_ca_certificate(pem::encode(\u0026cert).as_bytes()) {\n                Ok(did_expire) =\u003e if did_expire { pool.expired = true },\n                Err(e) =\u003e return Err(e)\n            }\n        }\n\n        Ok(pool)\n    }\n\n    /// Add a given CA certificate to the CA pool. If the certificate is expired, it will **still be added** - the return value will be `true` instead of `false`\n    /// # Errors\n    /// This function will return an error if the certificate is invalid in any way.\n    pub fn add_ca_certificate(\u0026mut self, bytes: \u0026[u8]) -\u003e Result\u003cbool, Box\u003cdyn Error\u003e\u003e {\n        let cert = deserialize_nebula_certificate_from_pem(bytes)?;\n\n        if !cert.details.is_ca {\n            return Err(CaPoolError::NotACA.into())\n        }\n\n        if !cert.check_signature(\u0026VerifyingKey::from_bytes(\u0026cert.details.public_key)?)? {\n            return Err(CaPoolError::NotSelfSigned.into())\n        }\n\n        let fingerprint = cert.sha256sum()?;\n        let expired = cert.expired(SystemTime::now());\n\n        self.cas.insert(fingerprint, cert);\n\n       Ok(expired)\n    }\n\n    /// Blocklist the given certificate in the CA pool\n    pub fn blocklist_fingerprint(\u0026mut self, fingerprint: \u0026str) {\n        self.cert_blocklist.push(fingerprint.to_string());\n    }\n\n    /// Clears the list of blocklisted fingerprints\n    pub fn reset_blocklist(\u0026mut self) {\n        self.cert_blocklist = vec![];\n    }\n\n    /// Checks if the given certificate is blocklisted\n    pub fn is_blocklisted(\u0026self, cert: \u0026NebulaCertificate) -\u003e bool {\n        let Ok(h) = cert.sha256sum() else { return false };\n        self.cert_blocklist.contains(\u0026h)\n    }\n\n    /// Gets the CA certificate used to sign the given certificate\n    /// # Errors\n    /// This function will return an error if the certificate does not have an issuer attached (it is self-signed)\n    pub fn get_ca_for_cert(\u0026self, cert: \u0026NebulaCertificate) -\u003e Result\u003cOption\u003c\u0026NebulaCertificate\u003e, Box\u003cdyn Error\u003e\u003e {\n        if cert.details.issuer == String::new() {\n            return Err(CaPoolError::NoIssuer.into())\n        }\n\n        Ok(self.cas.get(\u0026cert.details.issuer))\n    }\n\n    /// Get a list of trusted CA fingerprints\n    pub fn get_fingerprints(\u0026self) -\u003e Vec\u003c\u0026String\u003e {\n        self.cas.keys().collect()\n    }\n}\n\n#[derive(Debug)]\n/// A list of errors that can happen when working with a CA Pool\npub enum CaPoolError {\n    /// Tried to add a non-CA cert to the CA pool\n    NotACA,\n    /// Tried to add a non-self-signed cert to the CA pool (all CAs must be root certificates)\n    NotSelfSigned,\n    /// Tried to look up a certificate that does not have an issuer field\n    NoIssuer\n}\nimpl Error for CaPoolError {}\nimpl Display for CaPoolError {\n    fn fmt(\u0026self, f: \u0026mut Formatter\u003c'_\u003e) -\u003e std::fmt::Result {\n        match self {\n            Self::NotACA =\u003e write!(f, \"Tried to add a non-CA cert to the CA pool\"),\n            Self::NotSelfSigned =\u003e write!(f, \"Tried to add a non-self-signed cert to the CA pool (all CAs must be root certificates)\"),\n            Self::NoIssuer =\u003e write!(f, \"Tried to look up a certificate with a null issuer field\")\n        }\n    }\n}","traces":[{"line":24,"address":[439120],"length":1,"stats":{"Line":1},"fn_name":"new"},{"line":25,"address":[439128],"length":1,"stats":{"Line":1},"fn_name":null},{"line":33,"address":[439152,439962,440276],"length":1,"stats":{"Line":0},"fn_name":"new_from_pem"},{"line":34,"address":[439185,439319],"length":1,"stats":{"Line":0},"fn_name":null},{"line":36,"address":[439309],"length":1,"stats":{"Line":0},"fn_name":null},{"line":38,"address":[439541,440212,439447,440091],"length":1,"stats":{"Line":0},"fn_name":null},{"line":39,"address":[439842,439924,439763],"length":1,"stats":{"Line":0},"fn_name":null},{"line":40,"address":[440183,439973],"length":1,"stats":{"Line":0},"fn_name":null},{"line":41,"address":[440010],"length":1,"stats":{"Line":0},"fn_name":null},{"line":45,"address":[440217],"length":1,"stats":{"Line":0},"fn_name":null},{"line":51,"address":[441708,440304],"length":1,"stats":{"Line":1},"fn_name":"add_ca_certificate"},{"line":52,"address":[440534,440376],"length":1,"stats":{"Line":1},"fn_name":null},{"line":54,"address":[440514],"length":1,"stats":{"Line":1},"fn_name":null},{"line":55,"address":[440614,440703],"length":1,"stats":{"Line":0},"fn_name":null},{"line":58,"address":[440970,440607,440728],"length":1,"stats":{"Line":3},"fn_name":null},{"line":59,"address":[441139],"length":1,"stats":{"Line":0},"fn_name":null},{"line":62,"address":[441333,441215,441132],"length":1,"stats":{"Line":2},"fn_name":null},{"line":63,"address":[441490,441305],"length":1,"stats":{"Line":2},"fn_name":null},{"line":65,"address":[441514],"length":1,"stats":{"Line":1},"fn_name":null},{"line":67,"address":[441652],"length":1,"stats":{"Line":1},"fn_name":null},{"line":71,"address":[441760],"length":1,"stats":{"Line":1},"fn_name":"blocklist_fingerprint"},{"line":72,"address":[441779],"length":1,"stats":{"Line":1},"fn_name":null},{"line":76,"address":[441824,441888],"length":1,"stats":{"Line":1},"fn_name":"reset_blocklist"},{"line":77,"address":[441842,441920],"length":1,"stats":{"Line":2},"fn_name":null},{"line":81,"address":[442212,442240,441952],"length":1,"stats":{"Line":1},"fn_name":"is_blocklisted"},{"line":82,"address":[441974,442151,442094],"length":1,"stats":{"Line":1},"fn_name":null},{"line":83,"address":[442121,442173],"length":1,"stats":{"Line":2},"fn_name":null},{"line":89,"address":[442256,442390],"length":1,"stats":{"Line":1},"fn_name":"get_ca_for_cert"},{"line":90,"address":[442289],"length":1,"stats":{"Line":1},"fn_name":null},{"line":91,"address":[442455],"length":1,"stats":{"Line":0},"fn_name":null},{"line":94,"address":[442422],"length":1,"stats":{"Line":1},"fn_name":null},{"line":98,"address":[442496],"length":1,"stats":{"Line":0},"fn_name":"get_fingerprints"},{"line":99,"address":[442515],"length":1,"stats":{"Line":0},"fn_name":null},{"line":115,"address":[442560],"length":1,"stats":{"Line":0},"fn_name":"fmt"},{"line":116,"address":[442587],"length":1,"stats":{"Line":0},"fn_name":null},{"line":117,"address":[442619],"length":1,"stats":{"Line":0},"fn_name":null},{"line":118,"address":[442676],"length":1,"stats":{"Line":0},"fn_name":null},{"line":119,"address":[442733],"length":1,"stats":{"Line":0},"fn_name":null}],"covered":20,"coverable":38},{"path":["/","home","core","prj","e3t","trifid","trifid-pki","src","cert.rs"],"content":"//! Manage Nebula PKI Certificates\n//! This is pretty much a direct port of nebula/cert/cert.go\n\nuse std::error::Error;\nuse std::fmt::{Display, Formatter};\nuse std::net::Ipv4Addr;\nuse std::ops::Add;\nuse std::time::{Duration, SystemTime, UNIX_EPOCH};\nuse ed25519_dalek::{Signature, Signer, SigningKey, Verifier, VerifyingKey};\nuse ipnet::{Ipv4Net};\nuse pem::Pem;\nuse quick_protobuf::{BytesReader, MessageRead, MessageWrite, Writer};\nuse sha2::Sha256;\nuse crate::ca::NebulaCAPool;\nuse crate::cert_codec::{RawNebulaCertificate, RawNebulaCertificateDetails};\nuse sha2::Digest;\n\n/// The length, in bytes, of public keys\npub const PUBLIC_KEY_LENGTH: i32 = 32;\n\n/// The PEM banner for certificates\npub const CERT_BANNER: \u0026str = \"NEBULA CERTIFICATE\";\n/// The PEM banner for X25519 private keys\npub const X25519_PRIVATE_KEY_BANNER: \u0026str = \"NEBULA X25519 PRIVATE KEY\";\n/// The PEM banner for X25519 public keys\npub const X25519_PUBLIC_KEY_BANNER: \u0026str = \"NEBULA X25519 PUBLIC KEY\";\n/// The PEM banner for Ed25519 private keys\npub const ED25519_PRIVATE_KEY_BANNER: \u0026str = \"NEBULA ED25519 PRIVATE KEY\";\n/// The PEM banner for Ed25519 public keys\npub const ED25519_PUBLIC_KEY_BANNER: \u0026str = \"NEBULA ED25519 PUBLIC KEY\";\n\n/// A Nebula PKI certificate\n#[derive(Debug, Clone)]\npub struct NebulaCertificate {\n    /// The signed data of this certificate\n    pub details: NebulaCertificateDetails,\n    /// The Ed25519 signature of this certificate\n    pub signature: Vec\u003cu8\u003e\n}\n\n/// The signed details contained in a Nebula PKI certificate\n#[derive(Debug, Clone)]\npub struct NebulaCertificateDetails {\n    /// The name of the identity this certificate was issued for\n    pub name: String,\n    /// The IPv4 addresses issued to this node\n    pub ips: Vec\u003cIpv4Net\u003e,\n    /// The IPv4 subnets this node is responsible for routing\n    pub subnets: Vec\u003cIpv4Net\u003e,\n    /// The groups this node is a part of\n    pub groups: Vec\u003cString\u003e,\n    /// Certificate start date and time\n    pub not_before: SystemTime,\n    /// Certificate expiry date and time\n    pub not_after: SystemTime,\n    /// Public key\n    pub public_key: [u8; PUBLIC_KEY_LENGTH as usize],\n    /// Is this node a CA?\n    pub is_ca: bool,\n    /// SHA256 of issuer certificate. If blank, this cert is self-signed.\n    pub issuer: String\n}\n\n/// A list of errors that can occur parsing certificates\n#[derive(Debug)]\npub enum CertificateError {\n    /// Attempted to deserialize a certificate from an empty byte array\n    EmptyByteArray,\n    /// The encoded Details field is null\n    NilDetails,\n    /// The encoded Ips field is not formatted correctly\n    IpsNotPairs,\n    /// The encoded Subnets field is not formatted correctly\n    SubnetsNotPairs,\n    /// Signatures are expected to be 64 bytes but the signature on the certificate was a different length\n    WrongSigLength,\n    /// Public keys are expected to be 32 bytes but the public key on this cert is not\n    WrongKeyLength,\n    /// Certificates should have the PEM tag `NEBULA CERTIFICATE`, but this block did not\n    WrongPemTag,\n    /// This certificate either is not yet valid or has already expired\n    Expired,\n    /// The public key does not match the expected value\n    KeyMismatch\n}\nimpl Display for CertificateError {\n    fn fmt(\u0026self, f: \u0026mut Formatter\u003c'_\u003e) -\u003e std::fmt::Result {\n        match self {\n            Self::EmptyByteArray =\u003e write!(f, \"Certificate bytearray is empty\"),\n            Self::NilDetails =\u003e write!(f, \"The encoded Details field is null\"),\n            Self::IpsNotPairs =\u003e write!(f, \"encoded IPs should be in pairs, an odd number was found\"),\n            Self::SubnetsNotPairs =\u003e write!(f, \"encoded subnets should be in pairs, an odd number was found\"),\n            Self::WrongSigLength =\u003e write!(f, \"Signature should be 64 bytes but is a different size\"),\n            Self::WrongKeyLength =\u003e write!(f, \"Public keys are expected to be 32 bytes but the public key on this cert is not\"),\n            Self::WrongPemTag =\u003e write!(f, \"Certificates should have the PEM tag `NEBULA CERTIFICATE`, but this block did not\"),\n            Self::Expired =\u003e write!(f, \"This certificate either is not yet valid or has already expired\"),\n            Self::KeyMismatch =\u003e write!(f, \"Key does not match expected value\")\n        }\n    }\n}\nimpl Error for CertificateError {}\n\nfn map_cidr_pairs(pairs: \u0026[u32]) -\u003e Result\u003cVec\u003cIpv4Net\u003e, Box\u003cdyn Error\u003e\u003e {\n    let mut res_vec = vec![];\n    for pair in pairs.chunks(2) {\n        res_vec.push(Ipv4Net::with_netmask(Ipv4Addr::from(pair[0]), Ipv4Addr::from(pair[1]))?);\n    }\n    Ok(res_vec)\n}\n\nimpl Display for NebulaCertificate {\n    #[allow(clippy::unwrap_used)]\n    fn fmt(\u0026self, f: \u0026mut Formatter\u003c'_\u003e) -\u003e std::fmt::Result {\n        writeln!(f, \"NebulaCertificate {{\")?;\n        writeln!(f, \"   Details {{\")?;\n        writeln!(f, \"       Name: {}\", self.details.name)?;\n        writeln!(f, \"       Ips: {:?}\", self.details.ips)?;\n        writeln!(f, \"       Subnets: {:?}\", self.details.subnets)?;\n        writeln!(f, \"       Groups: {:?}\", self.details.groups)?;\n        writeln!(f, \"       Not before: {:?}\", self.details.not_before)?;\n        writeln!(f, \"       Not after: {:?}\", self.details.not_after)?;\n        writeln!(f, \"       Is CA: {}\", self.details.is_ca)?;\n        writeln!(f, \"       Issuer: {}\", self.details.issuer)?;\n        writeln!(f, \"       Public key: {}\", hex::encode(self.details.public_key))?;\n        writeln!(f, \"   }}\")?;\n        writeln!(f, \"   Fingerprint: {}\", self.sha256sum().unwrap())?;\n        writeln!(f, \"   Signature: {}\", hex::encode(self.signature.clone()))?;\n        writeln!(f, \"}}\")\n    }\n}\n\n/// Given a protobuf-encoded certificate bytearray, deserialize it into a `NebulaCertificate` object.\n/// # Errors\n/// This function will return an error if there is a protobuf parsing error, or if the certificate data is invalid.\n/// # Panics\npub fn deserialize_nebula_certificate(bytes: \u0026[u8]) -\u003e Result\u003cNebulaCertificate, Box\u003cdyn Error\u003e\u003e {\n    if bytes.is_empty() {\n        return Err(CertificateError::EmptyByteArray.into())\n    }\n\n    let mut reader = BytesReader::from_bytes(bytes);\n\n    let raw_cert = RawNebulaCertificate::from_reader(\u0026mut reader, bytes)?;\n\n    let details = raw_cert.Details.ok_or(CertificateError::NilDetails)?;\n\n    if details.Ips.len() % 2 != 0 {\n        return Err(CertificateError::IpsNotPairs.into())\n    }\n\n    if details.Subnets.len() % 2 != 0 {\n        return Err(CertificateError::SubnetsNotPairs.into())\n    }\n\n    let mut nebula_cert;\n    #[allow(clippy::cast_sign_loss)]\n    {\n        nebula_cert = NebulaCertificate {\n            details: NebulaCertificateDetails {\n                name: details.Name.to_string(),\n                ips: map_cidr_pairs(\u0026details.Ips)?,\n                subnets: map_cidr_pairs(\u0026details.Subnets)?,\n                groups: details.Groups.iter().map(std::string::ToString::to_string).collect(),\n                not_before: SystemTime::UNIX_EPOCH.add(Duration::from_secs(details.NotBefore as u64)),\n                not_after: SystemTime::UNIX_EPOCH.add(Duration::from_secs(details.NotAfter as u64)),\n                public_key: [0u8; 32],\n                is_ca: details.IsCA,\n                issuer: hex::encode(details.Issuer),\n            },\n            signature: vec![],\n        };\n    }\n\n    nebula_cert.signature = raw_cert.Signature;\n\n    if details.PublicKey.len() != 32 {\n        return Err(CertificateError::WrongKeyLength.into())\n    }\n\n    #[allow(clippy::unwrap_used)] { nebula_cert.details.public_key = details.PublicKey.try_into().unwrap(); }\n\n    Ok(nebula_cert)\n}\n\n/// A list of errors that can occur parsing keys\n#[derive(Debug)]\npub enum KeyError {\n    /// Keys should have their associated PEM tags but this had the wrong one\n    WrongPemTag\n}\nimpl Display for KeyError {\n    fn fmt(\u0026self, f: \u0026mut Formatter\u003c'_\u003e) -\u003e std::fmt::Result {\n        match self {\n            Self::WrongPemTag =\u003e write!(f, \"Keys should have their associated PEM tags but this had the wrong one\")\n        }\n    }\n}\nimpl Error for KeyError {}\n\n\n/// Deserialize the first PEM block in the given byte array into a `NebulaCertificate`\n/// # Errors\n/// This function will return an error if the PEM data is invalid, or if there is an error parsing the certificate (see `deserialize_nebula_certificate`)\npub fn deserialize_nebula_certificate_from_pem(bytes: \u0026[u8]) -\u003e Result\u003cNebulaCertificate, Box\u003cdyn Error\u003e\u003e {\n    let pem = pem::parse(bytes)?;\n    if pem.tag != CERT_BANNER {\n        return Err(CertificateError::WrongPemTag.into())\n    }\n    deserialize_nebula_certificate(\u0026pem.contents)\n}\n\n/// Simple helper to PEM encode an X25519 private key\npub fn serialize_x25519_private(bytes: \u0026[u8]) -\u003e Vec\u003cu8\u003e {\n    pem::encode(\u0026Pem {\n        tag: X25519_PRIVATE_KEY_BANNER.to_string(),\n        contents: bytes.to_vec(),\n    }).as_bytes().to_vec()\n}\n\n/// Simple helper to PEM encode an X25519 public key\npub fn serialize_x25519_public(bytes: \u0026[u8]) -\u003e Vec\u003cu8\u003e {\n    pem::encode(\u0026Pem {\n        tag: X25519_PUBLIC_KEY_BANNER.to_string(),\n        contents: bytes.to_vec(),\n    }).as_bytes().to_vec()\n}\n\n/// Attempt to deserialize a PEM encoded X25519 private key\n/// # Errors\n/// This function will return an error if the PEM data is invalid or has the wrong tag\npub fn deserialize_x25519_private(bytes: \u0026[u8]) -\u003e Result\u003cVec\u003cu8\u003e, Box\u003cdyn Error\u003e\u003e {\n    let pem = pem::parse(bytes)?;\n    if pem.tag != X25519_PRIVATE_KEY_BANNER {\n        return Err(KeyError::WrongPemTag.into())\n    }\n    Ok(pem.contents)\n}\n\n/// Attempt to deserialize a PEM encoded X25519 public key\n/// # Errors\n/// This function will return an error if the PEM data is invalid or has the wrong tag\npub fn deserialize_x25519_public(bytes: \u0026[u8]) -\u003e Result\u003cVec\u003cu8\u003e, Box\u003cdyn Error\u003e\u003e {\n    let pem = pem::parse(bytes)?;\n    if pem.tag != X25519_PUBLIC_KEY_BANNER {\n        return Err(KeyError::WrongPemTag.into())\n    }\n    Ok(pem.contents)\n}\n\n/// Simple helper to PEM encode an Ed25519 private key\npub fn serialize_ed25519_private(bytes: \u0026[u8]) -\u003e Vec\u003cu8\u003e {\n    pem::encode(\u0026Pem {\n        tag: ED25519_PRIVATE_KEY_BANNER.to_string(),\n        contents: bytes.to_vec(),\n    }).as_bytes().to_vec()\n}\n\n/// Simple helper to PEM encode an Ed25519 public key\npub fn serialize_ed25519_public(bytes: \u0026[u8]) -\u003e Vec\u003cu8\u003e {\n    pem::encode(\u0026Pem {\n        tag: ED25519_PUBLIC_KEY_BANNER.to_string(),\n        contents: bytes.to_vec(),\n    }).as_bytes().to_vec()\n}\n\n/// Attempt to deserialize a PEM encoded Ed25519 private key\n/// # Errors\n/// This function will return an error if the PEM data is invalid or has the wrong tag\npub fn deserialize_ed25519_private(bytes: \u0026[u8]) -\u003e Result\u003cVec\u003cu8\u003e, Box\u003cdyn Error\u003e\u003e {\n    let pem = pem::parse(bytes)?;\n    if pem.tag != ED25519_PRIVATE_KEY_BANNER {\n        return Err(KeyError::WrongPemTag.into())\n    }\n    Ok(pem.contents)\n}\n\n/// Attempt to deserialize a PEM encoded Ed25519 public key\n/// # Errors\n/// This function will return an error if the PEM data is invalid or has the wrong tag\npub fn deserialize_ed25519_public(bytes: \u0026[u8]) -\u003e Result\u003cVec\u003cu8\u003e, Box\u003cdyn Error\u003e\u003e {\n    let pem = pem::parse(bytes)?;\n    if pem.tag != ED25519_PUBLIC_KEY_BANNER {\n        return Err(KeyError::WrongPemTag.into())\n    }\n    Ok(pem.contents)\n}\n\nimpl NebulaCertificate {\n    /// Sign a nebula certificate with the provided private key\n    /// # Errors\n    /// This function will return an error if the certificate could not be serialized or signed.\n    pub fn sign(\u0026mut self, key: \u0026SigningKey) -\u003e Result\u003c(), Box\u003cdyn Error\u003e\u003e {\n        let mut out = Vec::new();\n        let mut writer = Writer::new(\u0026mut out);\n        self.get_raw_details().write_message(\u0026mut writer)?;\n\n        self.signature = key.sign(\u0026out).to_vec();\n        Ok(())\n    }\n\n    /// Verify the signature on a certificate with the provided public key\n    /// # Errors\n    /// This function will return an error if the certificate could not be serialized or the signature could not be checked.\n    pub fn check_signature(\u0026self, key: \u0026VerifyingKey) -\u003e Result\u003cbool, Box\u003cdyn Error\u003e\u003e {\n        let mut out = Vec::new();\n        let mut writer = Writer::new(\u0026mut out);\n        self.get_raw_details().write_message(\u0026mut writer)?;\n\n        let sig = Signature::from_slice(\u0026self.signature)?;\n\n        Ok(key.verify(\u0026out, \u0026sig).is_ok())\n    }\n\n    /// Returns true if the signature is too young or too old compared to the provided time\n    pub fn expired(\u0026self, time: SystemTime) -\u003e bool {\n        self.details.not_before \u003e time || self.details.not_after \u003c time\n    }\n\n    /// Verify will ensure a certificate is good in all respects (expiry, group membership, signature, cert blocklist, etc)\n    /// # Errors\n    /// This function will return an error if there is an error parsing the cert or the CA pool.\n    pub fn verify(\u0026self, time: SystemTime, ca_pool: \u0026NebulaCAPool) -\u003e Result\u003cCertificateValidity, Box\u003cdyn Error\u003e\u003e {\n        if ca_pool.is_blocklisted(self) {\n            return Ok(CertificateValidity::Blocklisted);\n        }\n\n        let Some(signer) = ca_pool.get_ca_for_cert(self)? else { return Ok(CertificateValidity::NotSignedByThisCAPool) };\n\n        if signer.expired(time) {\n            return Ok(CertificateValidity::RootCertExpired)\n        }\n\n        if self.expired(time) {\n            return Ok(CertificateValidity::CertExpired)\n        }\n\n        if !self.check_signature(\u0026VerifyingKey::from_bytes(\u0026signer.details.public_key)?)? {\n            return Ok(CertificateValidity::BadSignature)\n        }\n\n        Ok(self.check_root_constraints(signer))\n    }\n\n    /// Make sure that this certificate does not break any of the constraints set by the signing certificate\n    pub fn check_root_constraints(\u0026self, signer: \u0026Self) -\u003e CertificateValidity {\n        // Make sure this cert doesn't expire after the signer\n        println!(\"{:?} {:?}\", signer.details.not_before, self.details.not_before);\n        if signer.details.not_before \u003c self.details.not_before {\n            return CertificateValidity::CertExpiresAfterSigner;\n        }\n\n        // Make sure this cert doesn't come into validity before the root\n        if signer.details.not_before \u003e self.details.not_before {\n            return CertificateValidity::CertValidBeforeSigner;\n        }\n\n        // If the signer contains a limited set of groups, make sure this cert only has a subset of them\n        if !signer.details.groups.is_empty() {\n            println!(\"root groups: {:?}, child groups: {:?}\", signer.details.groups, self.details.groups);\n            for group in \u0026self.details.groups {\n                if !signer.details.groups.contains(group) {\n                    return CertificateValidity::GroupNotPresentOnSigner;\n                }\n            }\n        }\n\n        // If the signer contains a limited set of IP ranges, make sure the cert only contains a subset\n        if !signer.details.ips.is_empty() {\n            for ip in \u0026self.details.ips {\n                if !net_match(*ip, \u0026signer.details.ips) {\n                    return CertificateValidity::IPNotPresentOnSigner;\n                }\n            }\n        }\n\n        // If the signer contains a limited set of subnets, make sure the cert only contains a subset\n        if !signer.details.subnets.is_empty() {\n            for subnet in \u0026self.details.subnets {\n                if !net_match(*subnet, \u0026signer.details.subnets) {\n                    return CertificateValidity::SubnetNotPresentOnSigner;\n                }\n            }\n        }\n\n        CertificateValidity::Ok\n    }\n\n    #[allow(clippy::unwrap_used)]\n    /// Verify if the given private key corresponds to the public key contained in this certificate\n    /// # Errors\n    /// This function will return an error if either keys are invalid.\n    /// # Panics\n    /// This function, while containing calls to unwrap, has proper bounds checking and will not panic.\n    pub fn verify_private_key(\u0026self, key: \u0026[u8]) -\u003e Result\u003c(), Box\u003cdyn Error\u003e\u003e {\n        if self.details.is_ca {\n            // convert the keys\n            if key.len() != 64 {\n                return Err(\"key not 64-bytes long\".into())\n            }\n\n\n            let secret = SigningKey::from_keypair_bytes(key.try_into().unwrap())?;\n            let pub_key = secret.verifying_key().to_bytes();\n            if pub_key != self.details.public_key {\n                return Err(CertificateError::KeyMismatch.into());\n            }\n\n            return Ok(());\n        }\n\n        if key.len() != 32 {\n            return Err(\"key not 32-bytes long\".into())\n        }\n\n        let pubkey_raw = SigningKey::from_bytes(key.try_into()?).verifying_key();\n        let pubkey = pubkey_raw.as_bytes();\n\n        println!(\"{} {}\", hex::encode(pubkey), hex::encode(self.details.public_key));\n        if *pubkey != self.details.public_key {\n            return Err(CertificateError::KeyMismatch.into());\n        }\n\n        Ok(())\n    }\n\n\n    /// Get a protobuf-ready raw struct, ready for serialization\n    #[allow(clippy::expect_used)]\n    #[allow(clippy::cast_possible_wrap)]\n    /// # Panics\n    /// This function will panic if time went backwards, or if the certificate contains extremely invalid data.\n    pub fn get_raw_details(\u0026self) -\u003e RawNebulaCertificateDetails {\n\n        let mut raw = RawNebulaCertificateDetails {\n            Name: self.details.name.clone(),\n            Ips: vec![],\n            Subnets: vec![],\n            Groups: self.details.groups.iter().map(std::convert::Into::into).collect(),\n            NotBefore: self.details.not_before.duration_since(UNIX_EPOCH).expect(\"Time went backwards\").as_secs() as i64,\n            NotAfter: self.details.not_after.duration_since(UNIX_EPOCH).expect(\"Time went backwards\").as_secs() as i64,\n            PublicKey: self.details.public_key.into(),\n            IsCA: self.details.is_ca,\n            Issuer: hex::decode(\u0026self.details.issuer).expect(\"Issuer was not a hex-encoded value\"),\n        };\n\n        for ip_net in \u0026self.details.ips {\n            raw.Ips.push(ip_net.addr().into());\n            raw.Ips.push(ip_net.netmask().into());\n        }\n\n        for subnet in \u0026self.details.subnets {\n            raw.Subnets.push(subnet.addr().into());\n            raw.Subnets.push(subnet.netmask().into());\n        }\n\n        raw\n    }\n\n    /// Will serialize this cert into a protobuf byte array.\n    /// # Errors\n    /// This function will return an error if protobuf was unable to serialize the data.\n    pub fn serialize(\u0026self) -\u003e Result\u003cVec\u003cu8\u003e, Box\u003cdyn Error\u003e\u003e {\n        let raw_cert = RawNebulaCertificate {\n            Details: Some(self.get_raw_details()),\n            Signature: self.signature.clone(),\n        };\n\n        let mut out = vec![];\n        let mut writer = Writer::new(\u0026mut out);\n        raw_cert.write_message(\u0026mut writer)?;\n\n        Ok(out)\n    }\n\n    /// Will serialize this cert into a PEM byte array.\n    /// # Errors\n    /// This function will return an error if protobuf was unable to serialize the data.\n    pub fn serialize_to_pem(\u0026self) -\u003e Result\u003cVec\u003cu8\u003e, Box\u003cdyn Error\u003e\u003e {\n        let pbuf_bytes = self.serialize()?;\n\n        Ok(pem::encode(\u0026Pem {\n            tag: CERT_BANNER.to_string(),\n            contents: pbuf_bytes,\n        }).as_bytes().to_vec())\n    }\n\n    /// Get the fingerprint of this certificate\n    /// # Errors\n    /// This functiom will return an error if protobuf was unable to serialize the cert.\n    pub fn sha256sum(\u0026self) -\u003e Result\u003cString, Box\u003cdyn Error\u003e\u003e {\n        let pbuf_bytes = self.serialize()?;\n\n        let mut hasher = Sha256::new();\n        hasher.update(pbuf_bytes);\n\n        Ok(hex::encode(hasher.finalize()))\n    }\n}\n\n/// A list of possible errors that can happen validating a certificate\n#[derive(Eq, PartialEq, Debug)]\npub enum CertificateValidity {\n    /// There are no issues with this certificate\n    Ok,\n    /// This cert has been blocklisted in the given CA pool\n    Blocklisted,\n    /// The certificate that signed this cert is expired\n    RootCertExpired,\n    /// This cert is expired\n    CertExpired,\n    /// This cert's signature is invalid\n    BadSignature,\n    /// This cert was not signed by any CAs in the CA pool\n    NotSignedByThisCAPool,\n    /// This cert expires after the signer's cert expires\n    CertExpiresAfterSigner,\n    /// This cert enters validity before the signer's cert does\n    CertValidBeforeSigner,\n    /// A group present on this certificate is not present on the signer's certificate\n    GroupNotPresentOnSigner,\n    /// An IP present on this certificate is not present on the signer's certificate\n    IPNotPresentOnSigner,\n    /// A subnet on this certificate is not present on the signer's certificate\n    SubnetNotPresentOnSigner\n}\n\nfn net_match(cert_ip: Ipv4Net, root_ips: \u0026Vec\u003cIpv4Net\u003e) -\u003e bool {\n    for net in root_ips {\n        if net.contains(\u0026cert_ip) {\n            return true;\n        }\n    }\n    false\n}","traces":[{"line":87,"address":[527088],"length":1,"stats":{"Line":0},"fn_name":"fmt"},{"line":88,"address":[527115],"length":1,"stats":{"Line":0},"fn_name":null},{"line":89,"address":[527146],"length":1,"stats":{"Line":0},"fn_name":null},{"line":90,"address":[527206],"length":1,"stats":{"Line":0},"fn_name":null},{"line":91,"address":[527266],"length":1,"stats":{"Line":0},"fn_name":null},{"line":92,"address":[527326],"length":1,"stats":{"Line":0},"fn_name":null},{"line":93,"address":[527392],"length":1,"stats":{"Line":0},"fn_name":null},{"line":94,"address":[527458],"length":1,"stats":{"Line":0},"fn_name":null},{"line":95,"address":[527524],"length":1,"stats":{"Line":0},"fn_name":null},{"line":96,"address":[527587],"length":1,"stats":{"Line":0},"fn_name":null},{"line":97,"address":[527650],"length":1,"stats":{"Line":0},"fn_name":null},{"line":103,"address":[528659,527728],"length":1,"stats":{"Line":1},"fn_name":"map_cidr_pairs"},{"line":104,"address":[527771],"length":1,"stats":{"Line":1},"fn_name":null},{"line":105,"address":[528093,527808,527869],"length":1,"stats":{"Line":3},"fn_name":null},{"line":106,"address":[528654,528135],"length":1,"stats":{"Line":2},"fn_name":null},{"line":108,"address":[528006],"length":1,"stats":{"Line":1},"fn_name":null},{"line":113,"address":[528688,530741],"length":1,"stats":{"Line":1},"fn_name":"fmt"},{"line":114,"address":[528721,528922],"length":1,"stats":{"Line":1},"fn_name":null},{"line":115,"address":[528819,529100],"length":1,"stats":{"Line":1},"fn_name":null},{"line":116,"address":[529262,528969],"length":1,"stats":{"Line":1},"fn_name":null},{"line":117,"address":[529132,529424],"length":1,"stats":{"Line":1},"fn_name":null},{"line":118,"address":[529294,529589],"length":1,"stats":{"Line":1},"fn_name":null},{"line":119,"address":[529456,529751],"length":1,"stats":{"Line":1},"fn_name":null},{"line":120,"address":[529913,529621],"length":1,"stats":{"Line":1},"fn_name":null},{"line":121,"address":[529783,530078],"length":1,"stats":{"Line":1},"fn_name":null},{"line":122,"address":[530241,529945],"length":1,"stats":{"Line":1},"fn_name":null},{"line":123,"address":[530110,530348],"length":1,"stats":{"Line":1},"fn_name":null},{"line":124,"address":[530273,530687,530375],"length":1,"stats":{"Line":1},"fn_name":null},{"line":125,"address":[530846,530584],"length":1,"stats":{"Line":1},"fn_name":null},{"line":126,"address":[531168,530873,530785],"length":1,"stats":{"Line":1},"fn_name":null},{"line":127,"address":[531222,531501,531090],"length":1,"stats":{"Line":1},"fn_name":null},{"line":128,"address":[531431],"length":1,"stats":{"Line":1},"fn_name":null},{"line":136,"address":[533096,536605,531568],"length":1,"stats":{"Line":1},"fn_name":"deserialize_nebula_certificate"},{"line":137,"address":[531645],"length":1,"stats":{"Line":1},"fn_name":null},{"line":138,"address":[531839],"length":1,"stats":{"Line":1},"fn_name":null},{"line":141,"address":[531723],"length":1,"stats":{"Line":1},"fn_name":null},{"line":143,"address":[532102,531767,531953],"length":1,"stats":{"Line":2},"fn_name":null},{"line":145,"address":[532506,532328,532013],"length":1,"stats":{"Line":2},"fn_name":null},{"line":147,"address":[532468,532653],"length":1,"stats":{"Line":2},"fn_name":null},{"line":148,"address":[532690],"length":1,"stats":{"Line":1},"fn_name":null},{"line":151,"address":[532663,532797],"length":1,"stats":{"Line":2},"fn_name":null},{"line":152,"address":[532830],"length":1,"stats":{"Line":1},"fn_name":null},{"line":158,"address":[534614],"length":1,"stats":{"Line":1},"fn_name":null},{"line":159,"address":[534286],"length":1,"stats":{"Line":1},"fn_name":null},{"line":160,"address":[532807],"length":1,"stats":{"Line":1},"fn_name":null},{"line":161,"address":[533053,532953,533217,533107],"length":1,"stats":{"Line":3},"fn_name":null},{"line":162,"address":[533420,533571,533171],"length":1,"stats":{"Line":2},"fn_name":null},{"line":163,"address":[533848,533525],"length":1,"stats":{"Line":2},"fn_name":null},{"line":164,"address":[534030,533941],"length":1,"stats":{"Line":2},"fn_name":null},{"line":165,"address":[534087],"length":1,"stats":{"Line":1},"fn_name":null},{"line":166,"address":[534171],"length":1,"stats":{"Line":1},"fn_name":null},{"line":167,"address":[534190],"length":1,"stats":{"Line":1},"fn_name":null},{"line":168,"address":[534201],"length":1,"stats":{"Line":1},"fn_name":null},{"line":170,"address":[534517],"length":1,"stats":{"Line":1},"fn_name":null},{"line":174,"address":[534689],"length":1,"stats":{"Line":1},"fn_name":null},{"line":176,"address":[534871],"length":1,"stats":{"Line":1},"fn_name":null},{"line":177,"address":[534972],"length":1,"stats":{"Line":1},"fn_name":null},{"line":182,"address":[535933],"length":1,"stats":{"Line":1},"fn_name":null},{"line":192,"address":[536640],"length":1,"stats":{"Line":0},"fn_name":"fmt"},{"line":194,"address":[536658],"length":1,"stats":{"Line":0},"fn_name":null},{"line":204,"address":[537197,536720],"length":1,"stats":{"Line":1},"fn_name":"deserialize_nebula_certificate_from_pem"},{"line":205,"address":[536917,536753],"length":1,"stats":{"Line":2},"fn_name":null},{"line":206,"address":[536891,537049],"length":1,"stats":{"Line":2},"fn_name":null},{"line":207,"address":[537081],"length":1,"stats":{"Line":0},"fn_name":null},{"line":209,"address":[537174,537055],"length":1,"stats":{"Line":2},"fn_name":null},{"line":213,"address":[537443,537232],"length":1,"stats":{"Line":1},"fn_name":"serialize_x25519_private"},{"line":214,"address":[537370,537512,537582],"length":1,"stats":{"Line":3},"fn_name":null},{"line":215,"address":[537275],"length":1,"stats":{"Line":1},"fn_name":null},{"line":216,"address":[537310],"length":1,"stats":{"Line":1},"fn_name":null},{"line":217,"address":[537329],"length":1,"stats":{"Line":0},"fn_name":null},{"line":221,"address":[537859,537648],"length":1,"stats":{"Line":1},"fn_name":"serialize_x25519_public"},{"line":222,"address":[537786,537998,537928],"length":1,"stats":{"Line":3},"fn_name":null},{"line":223,"address":[537691],"length":1,"stats":{"Line":1},"fn_name":null},{"line":224,"address":[537726],"length":1,"stats":{"Line":1},"fn_name":null},{"line":225,"address":[537745],"length":1,"stats":{"Line":0},"fn_name":null},{"line":231,"address":[538064,538562],"length":1,"stats":{"Line":1},"fn_name":"deserialize_x25519_private"},{"line":232,"address":[538097,538258],"length":1,"stats":{"Line":2},"fn_name":null},{"line":233,"address":[538232,538390],"length":1,"stats":{"Line":2},"fn_name":null},{"line":234,"address":[538499],"length":1,"stats":{"Line":0},"fn_name":null},{"line":236,"address":[538401],"length":1,"stats":{"Line":1},"fn_name":null},{"line":242,"address":[539090,538592],"length":1,"stats":{"Line":1},"fn_name":"deserialize_x25519_public"},{"line":243,"address":[538625,538786],"length":1,"stats":{"Line":2},"fn_name":null},{"line":244,"address":[538760,538918],"length":1,"stats":{"Line":2},"fn_name":null},{"line":245,"address":[539027],"length":1,"stats":{"Line":0},"fn_name":null},{"line":247,"address":[538929],"length":1,"stats":{"Line":1},"fn_name":null},{"line":251,"address":[539120,539331],"length":1,"stats":{"Line":1},"fn_name":"serialize_ed25519_private"},{"line":252,"address":[539470,539258,539400],"length":1,"stats":{"Line":3},"fn_name":null},{"line":253,"address":[539163],"length":1,"stats":{"Line":1},"fn_name":null},{"line":254,"address":[539198],"length":1,"stats":{"Line":1},"fn_name":null},{"line":255,"address":[539217],"length":1,"stats":{"Line":0},"fn_name":null},{"line":259,"address":[539536,539747],"length":1,"stats":{"Line":1},"fn_name":"serialize_ed25519_public"},{"line":260,"address":[539886,539816,539674],"length":1,"stats":{"Line":3},"fn_name":null},{"line":261,"address":[539579],"length":1,"stats":{"Line":1},"fn_name":null},{"line":262,"address":[539614],"length":1,"stats":{"Line":1},"fn_name":null},{"line":263,"address":[539633],"length":1,"stats":{"Line":0},"fn_name":null},{"line":269,"address":[539952,540450],"length":1,"stats":{"Line":1},"fn_name":"deserialize_ed25519_private"},{"line":270,"address":[540146,539985],"length":1,"stats":{"Line":2},"fn_name":null},{"line":271,"address":[540278,540120],"length":1,"stats":{"Line":2},"fn_name":null},{"line":272,"address":[540387],"length":1,"stats":{"Line":0},"fn_name":null},{"line":274,"address":[540289],"length":1,"stats":{"Line":1},"fn_name":null},{"line":280,"address":[540480,540978],"length":1,"stats":{"Line":1},"fn_name":"deserialize_ed25519_public"},{"line":281,"address":[540674,540513],"length":1,"stats":{"Line":2},"fn_name":null},{"line":282,"address":[540806,540648],"length":1,"stats":{"Line":2},"fn_name":null},{"line":283,"address":[540915],"length":1,"stats":{"Line":0},"fn_name":null},{"line":285,"address":[540817],"length":1,"stats":{"Line":1},"fn_name":null},{"line":292,"address":[541008,541428,541730],"length":1,"stats":{"Line":1},"fn_name":"sign"},{"line":293,"address":[541041],"length":1,"stats":{"Line":1},"fn_name":null},{"line":294,"address":[541128,541065],"length":1,"stats":{"Line":2},"fn_name":null},{"line":295,"address":[541141],"length":1,"stats":{"Line":1},"fn_name":null},{"line":297,"address":[541468],"length":1,"stats":{"Line":1},"fn_name":null},{"line":298,"address":[541705],"length":1,"stats":{"Line":1},"fn_name":null},{"line":304,"address":[541760,542165,542610],"length":1,"stats":{"Line":1},"fn_name":"check_signature"},{"line":305,"address":[541803],"length":1,"stats":{"Line":1},"fn_name":null},{"line":306,"address":[541827,541890],"length":1,"stats":{"Line":2},"fn_name":null},{"line":307,"address":[541903],"length":1,"stats":{"Line":1},"fn_name":null},{"line":309,"address":[542197,542458],"length":1,"stats":{"Line":2},"fn_name":null},{"line":311,"address":[542427,542672,542564],"length":1,"stats":{"Line":3},"fn_name":null},{"line":315,"address":[542768],"length":1,"stats":{"Line":1},"fn_name":"expired"},{"line":316,"address":[542790],"length":1,"stats":{"Line":1},"fn_name":null},{"line":322,"address":[542864],"length":1,"stats":{"Line":1},"fn_name":"verify"},{"line":323,"address":[542939],"length":1,"stats":{"Line":1},"fn_name":null},{"line":324,"address":[543016],"length":1,"stats":{"Line":1},"fn_name":null},{"line":327,"address":[543173,542958,543040,543140],"length":1,"stats":{"Line":3},"fn_name":null},{"line":329,"address":[543157],"length":1,"stats":{"Line":1},"fn_name":null},{"line":330,"address":[543219],"length":1,"stats":{"Line":1},"fn_name":null},{"line":333,"address":[543203],"length":1,"stats":{"Line":1},"fn_name":null},{"line":334,"address":[543295],"length":1,"stats":{"Line":1},"fn_name":null},{"line":337,"address":[543311,543487,543239],"length":1,"stats":{"Line":3},"fn_name":null},{"line":338,"address":[543597],"length":1,"stats":{"Line":0},"fn_name":null},{"line":341,"address":[543565],"length":1,"stats":{"Line":1},"fn_name":null},{"line":345,"address":[543616],"length":1,"stats":{"Line":1},"fn_name":"check_root_constraints"},{"line":347,"address":[543662],"length":1,"stats":{"Line":1},"fn_name":null},{"line":348,"address":[543788],"length":1,"stats":{"Line":1},"fn_name":null},{"line":349,"address":[543834],"length":1,"stats":{"Line":0},"fn_name":null},{"line":353,"address":[543815],"length":1,"stats":{"Line":1},"fn_name":null},{"line":354,"address":[543876],"length":1,"stats":{"Line":0},"fn_name":null},{"line":358,"address":[543856],"length":1,"stats":{"Line":1},"fn_name":null},{"line":359,"address":[543917],"length":1,"stats":{"Line":1},"fn_name":null},{"line":360,"address":[544056],"length":1,"stats":{"Line":1},"fn_name":null},{"line":361,"address":[544164],"length":1,"stats":{"Line":1},"fn_name":null},{"line":362,"address":[544200],"length":1,"stats":{"Line":1},"fn_name":null},{"line":368,"address":[543888],"length":1,"stats":{"Line":1},"fn_name":null},{"line":369,"address":[544244],"length":1,"stats":{"Line":1},"fn_name":null},{"line":370,"address":[544341],"length":1,"stats":{"Line":1},"fn_name":null},{"line":371,"address":[544404],"length":1,"stats":{"Line":1},"fn_name":null},{"line":377,"address":[544215],"length":1,"stats":{"Line":1},"fn_name":null},{"line":378,"address":[544429],"length":1,"stats":{"Line":1},"fn_name":null},{"line":379,"address":[544526],"length":1,"stats":{"Line":1},"fn_name":null},{"line":380,"address":[544589],"length":1,"stats":{"Line":1},"fn_name":null},{"line":385,"address":[544414],"length":1,"stats":{"Line":1},"fn_name":null},{"line":394,"address":[544608,545205],"length":1,"stats":{"Line":1},"fn_name":"verify_private_key"},{"line":395,"address":[544663],"length":1,"stats":{"Line":1},"fn_name":null},{"line":397,"address":[544703],"length":1,"stats":{"Line":1},"fn_name":null},{"line":398,"address":[544799],"length":1,"stats":{"Line":0},"fn_name":null},{"line":402,"address":[544856,544725,544961],"length":1,"stats":{"Line":2},"fn_name":null},{"line":403,"address":[544942,545086],"length":1,"stats":{"Line":2},"fn_name":null},{"line":404,"address":[545109],"length":1,"stats":{"Line":1},"fn_name":null},{"line":405,"address":[545144],"length":1,"stats":{"Line":1},"fn_name":null},{"line":408,"address":[545130],"length":1,"stats":{"Line":1},"fn_name":null},{"line":411,"address":[544680],"length":1,"stats":{"Line":1},"fn_name":null},{"line":412,"address":[545319],"length":1,"stats":{"Line":0},"fn_name":null},{"line":415,"address":[545266,545357],"length":1,"stats":{"Line":2},"fn_name":null},{"line":416,"address":[545517],"length":1,"stats":{"Line":1},"fn_name":null},{"line":418,"address":[545554],"length":1,"stats":{"Line":1},"fn_name":null},{"line":419,"address":[545934],"length":1,"stats":{"Line":1},"fn_name":null},{"line":420,"address":[545960],"length":1,"stats":{"Line":1},"fn_name":null},{"line":423,"address":[545943],"length":1,"stats":{"Line":1},"fn_name":null},{"line":432,"address":[546016,547137],"length":1,"stats":{"Line":1},"fn_name":"get_raw_details"},{"line":435,"address":[546055],"length":1,"stats":{"Line":1},"fn_name":null},{"line":436,"address":[546084],"length":1,"stats":{"Line":1},"fn_name":null},{"line":437,"address":[546143],"length":1,"stats":{"Line":1},"fn_name":null},{"line":438,"address":[546290,546199],"length":1,"stats":{"Line":2},"fn_name":null},{"line":439,"address":[546391,546471],"length":1,"stats":{"Line":2},"fn_name":null},{"line":440,"address":[546581],"length":1,"stats":{"Line":1},"fn_name":null},{"line":441,"address":[546727],"length":1,"stats":{"Line":1},"fn_name":null},{"line":442,"address":[546781],"length":1,"stats":{"Line":1},"fn_name":null},{"line":443,"address":[546860,546794],"length":1,"stats":{"Line":2},"fn_name":null},{"line":446,"address":[547110,547216,547344],"length":1,"stats":{"Line":3},"fn_name":null},{"line":447,"address":[547365],"length":1,"stats":{"Line":1},"fn_name":null},{"line":448,"address":[547465],"length":1,"stats":{"Line":1},"fn_name":null},{"line":451,"address":[547567,547673,547312],"length":1,"stats":{"Line":3},"fn_name":null},{"line":452,"address":[547694],"length":1,"stats":{"Line":1},"fn_name":null},{"line":453,"address":[547794],"length":1,"stats":{"Line":1},"fn_name":null},{"line":462,"address":[547888,548103],"length":1,"stats":{"Line":1},"fn_name":"serialize"},{"line":464,"address":[547931],"length":1,"stats":{"Line":1},"fn_name":null},{"line":465,"address":[547968],"length":1,"stats":{"Line":1},"fn_name":null},{"line":468,"address":[548084],"length":1,"stats":{"Line":1},"fn_name":null},{"line":469,"address":[548229,548171],"length":1,"stats":{"Line":2},"fn_name":null},{"line":470,"address":[548258,548429],"length":1,"stats":{"Line":1},"fn_name":null},{"line":472,"address":[548318],"length":1,"stats":{"Line":1},"fn_name":null},{"line":478,"address":[548592,548943],"length":1,"stats":{"Line":1},"fn_name":"serialize_to_pem"},{"line":479,"address":[548617,548734],"length":1,"stats":{"Line":1},"fn_name":null},{"line":481,"address":[549018,549084,548852],"length":1,"stats":{"Line":3},"fn_name":null},{"line":482,"address":[548702],"length":1,"stats":{"Line":1},"fn_name":null},{"line":483,"address":[548826],"length":1,"stats":{"Line":1},"fn_name":null},{"line":490,"address":[549728,549697,549184],"length":1,"stats":{"Line":1},"fn_name":"sha256sum"},{"line":491,"address":[549208,549322],"length":1,"stats":{"Line":1},"fn_name":null},{"line":493,"address":[549311],"length":1,"stats":{"Line":1},"fn_name":null},{"line":494,"address":[549422],"length":1,"stats":{"Line":1},"fn_name":null},{"line":496,"address":[549479],"length":1,"stats":{"Line":1},"fn_name":null},{"line":527,"address":[549744],"length":1,"stats":{"Line":1},"fn_name":"net_match"},{"line":528,"address":[549858,549794],"length":1,"stats":{"Line":2},"fn_name":null},{"line":529,"address":[549868],"length":1,"stats":{"Line":1},"fn_name":null},{"line":530,"address":[549885],"length":1,"stats":{"Line":1},"fn_name":null},{"line":533,"address":[549851],"length":1,"stats":{"Line":1},"fn_name":null}],"covered":178,"coverable":205},{"path":["/","home","core","prj","e3t","trifid","trifid-pki","src","cert_codec.rs"],"content":"// Automatically generated rust module for 'cert_codec.proto' file\n\n#![allow(non_snake_case)]\n#![allow(non_upper_case_globals)]\n#![allow(non_camel_case_types)]\n#![allow(unused_imports)]\n#![allow(unknown_lints)]\n#![allow(clippy::all)]\n#![cfg_attr(rustfmt, rustfmt_skip)]\n#![allow(clippy::pedantic)]\n\nuse quick_protobuf::{MessageInfo, MessageRead, MessageWrite, BytesReader, Writer, WriterBackend, Result};\nuse quick_protobuf::sizeofs::*;\nuse super::*;\n\n#[allow(clippy::derive_partial_eq_without_eq)]\n#[derive(Debug, Default, PartialEq, Clone)]\npub struct RawNebulaCertificate {\n    pub Details: Option\u003ccert_codec::RawNebulaCertificateDetails\u003e,\n    pub Signature: Vec\u003cu8\u003e,\n}\n\nimpl\u003c'a\u003e MessageRead\u003c'a\u003e for RawNebulaCertificate {\n    fn from_reader(r: \u0026mut BytesReader, bytes: \u0026'a [u8]) -\u003e Result\u003cSelf\u003e {\n        let mut msg = Self::default();\n        while !r.is_eof() {\n            match r.next_tag(bytes) {\n                Ok(10) =\u003e msg.Details = Some(r.read_message::\u003ccert_codec::RawNebulaCertificateDetails\u003e(bytes)?),\n                Ok(18) =\u003e msg.Signature = r.read_bytes(bytes)?.to_owned(),\n                Ok(t) =\u003e { r.read_unknown(bytes, t)?; }\n                Err(e) =\u003e return Err(e),\n            }\n        }\n        Ok(msg)\n    }\n}\n\nimpl MessageWrite for RawNebulaCertificate {\n    fn get_size(\u0026self) -\u003e usize {\n        0\n        + self.Details.as_ref().map_or(0, |m| 1 + sizeof_len((m).get_size()))\n        + if self.Signature.is_empty() { 0 } else { 1 + sizeof_len((\u0026self.Signature).len()) }\n    }\n\n    fn write_message\u003cW: WriterBackend\u003e(\u0026self, w: \u0026mut Writer\u003cW\u003e) -\u003e Result\u003c()\u003e {\n        if let Some(ref s) = self.Details { w.write_with_tag(10, |w| w.write_message(s))?; }\n        if !self.Signature.is_empty() { w.write_with_tag(18, |w| w.write_bytes(\u0026**\u0026self.Signature))?; }\n        Ok(())\n    }\n}\n\n#[allow(clippy::derive_partial_eq_without_eq)]\n#[derive(Debug, Default, PartialEq, Clone)]\npub struct RawNebulaCertificateDetails {\n    pub Name: String,\n    pub Ips: Vec\u003cu32\u003e,\n    pub Subnets: Vec\u003cu32\u003e,\n    pub Groups: Vec\u003cString\u003e,\n    pub NotBefore: i64,\n    pub NotAfter: i64,\n    pub PublicKey: Vec\u003cu8\u003e,\n    pub IsCA: bool,\n    pub Issuer: Vec\u003cu8\u003e,\n}\n\nimpl\u003c'a\u003e MessageRead\u003c'a\u003e for RawNebulaCertificateDetails {\n    fn from_reader(r: \u0026mut BytesReader, bytes: \u0026'a [u8]) -\u003e Result\u003cSelf\u003e {\n        let mut msg = Self::default();\n        while !r.is_eof() {\n            match r.next_tag(bytes) {\n                Ok(10) =\u003e msg.Name = r.read_string(bytes)?.to_owned(),\n                Ok(18) =\u003e msg.Ips = r.read_packed(bytes, |r, bytes| Ok(r.read_uint32(bytes)?))?,\n                Ok(26) =\u003e msg.Subnets = r.read_packed(bytes, |r, bytes| Ok(r.read_uint32(bytes)?))?,\n                Ok(34) =\u003e msg.Groups.push(r.read_string(bytes)?.to_owned()),\n                Ok(40) =\u003e msg.NotBefore = r.read_int64(bytes)?,\n                Ok(48) =\u003e msg.NotAfter = r.read_int64(bytes)?,\n                Ok(58) =\u003e msg.PublicKey = r.read_bytes(bytes)?.to_owned(),\n                Ok(64) =\u003e msg.IsCA = r.read_bool(bytes)?,\n                Ok(74) =\u003e msg.Issuer = r.read_bytes(bytes)?.to_owned(),\n                Ok(t) =\u003e { r.read_unknown(bytes, t)?; }\n                Err(e) =\u003e return Err(e),\n            }\n        }\n        Ok(msg)\n    }\n}\n\nimpl MessageWrite for RawNebulaCertificateDetails {\n    fn get_size(\u0026self) -\u003e usize {\n        0\n        + if self.Name == String::default() { 0 } else { 1 + sizeof_len((\u0026self.Name).len()) }\n        + if self.Ips.is_empty() { 0 } else { 1 + sizeof_len(self.Ips.iter().map(|s| sizeof_varint(*(s) as u64)).sum::\u003cusize\u003e()) }\n        + if self.Subnets.is_empty() { 0 } else { 1 + sizeof_len(self.Subnets.iter().map(|s| sizeof_varint(*(s) as u64)).sum::\u003cusize\u003e()) }\n        + self.Groups.iter().map(|s| 1 + sizeof_len((s).len())).sum::\u003cusize\u003e()\n        + if self.NotBefore == 0i64 { 0 } else { 1 + sizeof_varint(*(\u0026self.NotBefore) as u64) }\n        + if self.NotAfter == 0i64 { 0 } else { 1 + sizeof_varint(*(\u0026self.NotAfter) as u64) }\n        + if self.PublicKey.is_empty() { 0 } else { 1 + sizeof_len((\u0026self.PublicKey).len()) }\n        + if self.IsCA == false { 0 } else { 1 + sizeof_varint(*(\u0026self.IsCA) as u64) }\n        + if self.Issuer.is_empty() { 0 } else { 1 + sizeof_len((\u0026self.Issuer).len()) }\n    }\n\n    fn write_message\u003cW: WriterBackend\u003e(\u0026self, w: \u0026mut Writer\u003cW\u003e) -\u003e Result\u003c()\u003e {\n        if self.Name != String::default() { w.write_with_tag(10, |w| w.write_string(\u0026**\u0026self.Name))?; }\n        w.write_packed_with_tag(18, \u0026self.Ips, |w, m| w.write_uint32(*m), \u0026|m| sizeof_varint(*(m) as u64))?;\n        w.write_packed_with_tag(26, \u0026self.Subnets, |w, m| w.write_uint32(*m), \u0026|m| sizeof_varint(*(m) as u64))?;\n        for s in \u0026self.Groups { w.write_with_tag(34, |w| w.write_string(\u0026**s))?; }\n        if self.NotBefore != 0i64 { w.write_with_tag(40, |w| w.write_int64(*\u0026self.NotBefore))?; }\n        if self.NotAfter != 0i64 { w.write_with_tag(48, |w| w.write_int64(*\u0026self.NotAfter))?; }\n        if !self.PublicKey.is_empty() { w.write_with_tag(58, |w| w.write_bytes(\u0026**\u0026self.PublicKey))?; }\n        if self.IsCA != false { w.write_with_tag(64, |w| w.write_bool(*\u0026self.IsCA))?; }\n        if !self.Issuer.is_empty() { w.write_with_tag(74, |w| w.write_bytes(\u0026**\u0026self.Issuer))?; }\n        Ok(())\n    }\n}\n\n","traces":[],"covered":0,"coverable":0},{"path":["/","home","core","prj","e3t","trifid","trifid-pki","src","lib.rs"],"content":"//! # trifid-pki\n//! trifid-pki is a crate for interacting with the Nebula PKI system. It was created to prevent the need to make constant CLI calls for signing operations in Nebula.\n//! It is designed to be interoperable with the original Go implementation and as such has some oddities with key management to ensure compatability.\n//!\n//! This crate has not received any format security audits, however the underlying crates used for actual cryptographic operations (ed25519-dalek and curve25519-dalek) have been audited with no major issues.\n\n#![warn(clippy::pedantic)]\n#![warn(clippy::nursery)]\n#![deny(clippy::unwrap_used)]\n#![deny(clippy::expect_used)]\n#![deny(missing_docs)]\n#![deny(clippy::missing_errors_doc)]\n#![deny(clippy::missing_panics_doc)]\n#![deny(clippy::missing_safety_doc)]\n#![allow(clippy::must_use_candidate)]\n#![allow(clippy::too_many_lines)]\n#![allow(clippy::module_name_repetitions)]\n\n\nextern crate core;\n\npub mod ca;\npub mod cert;\n#[cfg(not(tarpaulin_include))]\npub(crate) mod cert_codec;\n#[cfg(test)]\n#[macro_use]\npub mod test;","traces":[],"covered":0,"coverable":0},{"path":["/","home","core","prj","e3t","trifid","trifid-pki","src","test.rs"],"content":"#![allow(clippy::unwrap_used)]\n#![allow(clippy::expect_used)]\n\nuse crate::netmask;\nuse std::net::Ipv4Addr;\nuse std::ops::{Add, Sub};\nuse std::time::{Duration, SystemTime, SystemTimeError, UNIX_EPOCH};\nuse ipnet::Ipv4Net;\nuse crate::cert::{CertificateValidity, deserialize_ed25519_private, deserialize_ed25519_public, deserialize_nebula_certificate, deserialize_nebula_certificate_from_pem, deserialize_x25519_private, deserialize_x25519_public, NebulaCertificate, NebulaCertificateDetails, serialize_ed25519_private, serialize_ed25519_public, serialize_x25519_private, serialize_x25519_public};\nuse std::str::FromStr;\nuse ed25519_dalek::{SigningKey, VerifyingKey};\nuse quick_protobuf::{MessageWrite, Writer};\nuse rand::rngs::OsRng;\nuse crate::ca::NebulaCAPool;\nuse crate::cert_codec::{RawNebulaCertificate, RawNebulaCertificateDetails};\n\n/// This is a cert that we (e3team) actually use in production, and it's a known-good certificate.\npub const KNOWN_GOOD_CERT: \u0026[u8; 258] = b\"-----BEGIN NEBULA CERTIFICATE-----\\nCkkKF2UzdGVhbSBJbnRlcm5hbCBOZXR3b3JrKJWev5wGMJWFxKsGOiCvpwoHyKY5\\n8Q5+2XxDjtoCf/zlNY/EUdB8bwXQSwEo50ABEkB0Dx76lkMqc3IyH5+ml2dKjTyv\\nB4Jiw6x3abf5YZcf8rDuVEgQpvFdJmo3xJyIb3C9vKZ6kXsUxjw6s1JdWgkA\\n-----END NEBULA CERTIFICATE-----\";\n\n#[test]\nfn certificate_serialization() {\n    let before = round_systime_to_secs(SystemTime::now() - Duration::from_secs(60)).unwrap();\n    let after = round_systime_to_secs(SystemTime::now() + Duration::from_secs(60)).unwrap();\n    let pub_key = b\"1234567890abcedfghij1234567890ab\";\n\n    let cert = NebulaCertificate {\n        details: NebulaCertificateDetails {\n            name: \"testing\".to_string(),\n            ips: vec![\n                netmask!(\"10.1.1.1\", \"255.255.255.0\"),\n                netmask!(\"10.1.1.2\", \"255.255.0.0\"),\n                netmask!(\"10.1.1.3\", \"255.0.0.0\")\n            ],\n            subnets: vec![\n                netmask!(\"9.1.1.1\", \"255.255.255.128\"),\n                netmask!(\"9.1.1.2\", \"255.255.255.0\"),\n                netmask!(\"9.1.1.3\", \"255.255.0.0\")\n            ],\n            groups: vec![\"test-group1\".to_string(), \"test-group2\".to_string(), \"test-group3\".to_string()],\n            not_before: before,\n            not_after: after,\n            public_key: *pub_key,\n            is_ca: false,\n            issuer: \"1234567890abcedfabcd1234567890ab\".to_string(),\n        },\n        signature: b\"1234567890abcedfghij1234567890ab\".to_vec(),\n    };\n\n    let bytes = cert.serialize().unwrap();\n\n    let deserialized = deserialize_nebula_certificate(\u0026bytes).unwrap();\n\n    assert_eq!(cert.signature, deserialized.signature);\n    assert_eq!(cert.details.name, deserialized.details.name);\n    assert_eq!(cert.details.not_before, deserialized.details.not_before);\n    assert_eq!(cert.details.not_after, deserialized.details.not_after);\n    assert_eq!(cert.details.public_key, deserialized.details.public_key);\n    assert_eq!(cert.details.is_ca, deserialized.details.is_ca);\n\n    assert_eq!(cert.details.ips.len(), deserialized.details.ips.len());\n    for item in \u0026cert.details.ips {\n        assert!(deserialized.details.ips.contains(item), \"deserialized does not contain from source\");\n    }\n\n    assert_eq!(cert.details.subnets.len(), deserialized.details.subnets.len());\n    for item in \u0026cert.details.subnets {\n        assert!(deserialized.details.subnets.contains(item), \"deserialized does not contain from source\");\n    }\n\n    assert_eq!(cert.details.groups.len(), deserialized.details.groups.len());\n    for item in \u0026cert.details.groups {\n        assert!(deserialized.details.groups.contains(item), \"deserialized does not contain from source\");\n    }\n}\n\n#[test]\nfn certificate_serialization_pem() {\n    let before = round_systime_to_secs(SystemTime::now() - Duration::from_secs(60)).unwrap();\n    let after = round_systime_to_secs(SystemTime::now() + Duration::from_secs(60)).unwrap();\n    let pub_key = b\"1234567890abcedfghij1234567890ab\";\n\n    let cert = NebulaCertificate {\n        details: NebulaCertificateDetails {\n            name: \"testing\".to_string(),\n            ips: vec![\n                netmask!(\"10.1.1.1\", \"255.255.255.0\"),\n                netmask!(\"10.1.1.2\", \"255.255.0.0\"),\n                netmask!(\"10.1.1.3\", \"255.0.0.0\")\n            ],\n            subnets: vec![\n                netmask!(\"9.1.1.1\", \"255.255.255.128\"),\n                netmask!(\"9.1.1.2\", \"255.255.255.0\"),\n                netmask!(\"9.1.1.3\", \"255.255.0.0\")\n            ],\n            groups: vec![\"test-group1\".to_string(), \"test-group2\".to_string(), \"test-group3\".to_string()],\n            not_before: before,\n            not_after: after,\n            public_key: *pub_key,\n            is_ca: false,\n            issuer: \"1234567890abcedfabcd1234567890ab\".to_string(),\n        },\n        signature: b\"1234567890abcedfghij1234567890ab\".to_vec(),\n    };\n\n    let bytes = cert.serialize_to_pem().unwrap();\n\n    let deserialized = deserialize_nebula_certificate_from_pem(\u0026bytes).unwrap();\n\n    assert_eq!(cert.signature, deserialized.signature);\n    assert_eq!(cert.details.name, deserialized.details.name);\n    assert_eq!(cert.details.not_before, deserialized.details.not_before);\n    assert_eq!(cert.details.not_after, deserialized.details.not_after);\n    assert_eq!(cert.details.public_key, deserialized.details.public_key);\n    assert_eq!(cert.details.is_ca, deserialized.details.is_ca);\n\n    assert_eq!(cert.details.ips.len(), deserialized.details.ips.len());\n    for item in \u0026cert.details.ips {\n        assert!(deserialized.details.ips.contains(item), \"deserialized does not contain from source\");\n    }\n\n    assert_eq!(cert.details.subnets.len(), deserialized.details.subnets.len());\n    for item in \u0026cert.details.subnets {\n        assert!(deserialized.details.subnets.contains(item), \"deserialized does not contain from source\");\n    }\n\n    assert_eq!(cert.details.groups.len(), deserialized.details.groups.len());\n    for item in \u0026cert.details.groups {\n        assert!(deserialized.details.groups.contains(item), \"deserialized does not contain from source\");\n    }\n}\n\n#[test]\nfn cert_signing() {\n    let before = round_systime_to_secs(SystemTime::now() - Duration::from_secs(60)).unwrap();\n    let after = round_systime_to_secs(SystemTime::now() + Duration::from_secs(60)).unwrap();\n    let pub_key = b\"1234567890abcedfghij1234567890ab\";\n\n    let mut cert = NebulaCertificate {\n        details: NebulaCertificateDetails {\n            name: \"testing\".to_string(),\n            ips: vec![\n                netmask!(\"10.1.1.1\", \"255.255.255.0\"),\n                netmask!(\"10.1.1.2\", \"255.255.0.0\"),\n                netmask!(\"10.1.1.3\", \"255.0.0.0\")\n            ],\n            subnets: vec![\n                netmask!(\"9.1.1.1\", \"255.255.255.128\"),\n                netmask!(\"9.1.1.2\", \"255.255.255.0\"),\n                netmask!(\"9.1.1.3\", \"255.255.0.0\")\n            ],\n            groups: vec![\"test-group1\".to_string(), \"test-group2\".to_string(), \"test-group3\".to_string()],\n            not_before: before,\n            not_after: after,\n            public_key: *pub_key,\n            is_ca: false,\n            issuer: \"1234567890abcedfabcd1234567890ab\".to_string(),\n        },\n        signature: b\"1234567890abcedfghij1234567890ab\".to_vec(),\n    };\n\n    let mut csprng = OsRng;\n    let key = SigningKey::generate(\u0026mut csprng);\n\n    assert!(cert.check_signature(\u0026key.verifying_key()).is_err());\n    cert.sign(\u0026key).unwrap();\n    assert!(cert.check_signature(\u0026key.verifying_key()).unwrap());\n}\n\n#[test]\nfn cert_expiry() {\n    let cert = NebulaCertificate {\n        details: NebulaCertificateDetails {\n            name: String::new(),\n            ips: vec![],\n            subnets: vec![],\n            groups: vec![],\n            not_before: SystemTime::now().sub(Duration::from_secs(60)),\n            not_after: SystemTime::now().add(Duration::from_secs(60)),\n            public_key: [0u8; 32],\n            is_ca: false,\n            issuer: String::new(),\n        },\n        signature: vec![],\n    };\n\n    assert!(cert.expired(SystemTime::now().add(Duration::from_secs(60 * 60 * 60))));\n    assert!(cert.expired(SystemTime::now().sub(Duration::from_secs(60 * 60 * 60))));\n    assert!(!cert.expired(SystemTime::now()));\n}\n\n#[test]\nfn cert_display() {\n    let cert = NebulaCertificate {\n        details: NebulaCertificateDetails {\n            name: String::new(),\n            ips: vec![],\n            subnets: vec![],\n            groups: vec![],\n            not_before: SystemTime::now().sub(Duration::from_secs(60)),\n            not_after: SystemTime::now().add(Duration::from_secs(60)),\n            public_key: [0u8; 32],\n            is_ca: false,\n            issuer: String::new(),\n        },\n        signature: vec![],\n    };\n    println!(\"{cert}\");\n}\n\n#[test]\n#[should_panic]\nfn cert_deserialize_empty_bytes() {\n    deserialize_nebula_certificate(\u0026[]).unwrap();\n}\n\n#[test]\nfn cert_deserialize_unpaired_ips() {\n    let broken_cert = RawNebulaCertificate {\n        Details: Some(RawNebulaCertificateDetails {\n            Name: String::new(),\n            Ips: vec![0],\n            Subnets: vec![],\n            Groups: vec![],\n            NotBefore: 0,\n            NotAfter: 0,\n            PublicKey: vec![],\n            IsCA: false,\n            Issuer: vec![],\n        }),\n        Signature: vec![],\n    };\n    let mut bytes = vec![];\n    let mut writer = Writer::new(\u0026mut bytes);\n    broken_cert.write_message(\u0026mut writer).unwrap();\n\n    deserialize_nebula_certificate(\u0026bytes).unwrap_err();\n}\n\n#[test]\nfn cert_deserialize_unpaired_subnets() {\n    let broken_cert = RawNebulaCertificate {\n        Details: Some(RawNebulaCertificateDetails {\n            Name: String::new(),\n            Ips: vec![],\n            Subnets: vec![0],\n            Groups: vec![],\n            NotBefore: 0,\n            NotAfter: 0,\n            PublicKey: vec![],\n            IsCA: false,\n            Issuer: vec![],\n        }),\n        Signature: vec![],\n    };\n    let mut bytes = vec![];\n    let mut writer = Writer::new(\u0026mut bytes);\n    broken_cert.write_message(\u0026mut writer).unwrap();\n\n    deserialize_nebula_certificate(\u0026bytes).unwrap_err();\n}\n\n#[test]\nfn cert_deserialize_wrong_pubkey_len() {\n    let broken_cert = RawNebulaCertificate {\n        Details: Some(RawNebulaCertificateDetails {\n            Name: String::new(),\n            Ips: vec![],\n            Subnets: vec![],\n            Groups: vec![],\n            NotBefore: 0,\n            NotAfter: 0,\n            PublicKey: vec![0u8; 31],\n            IsCA: false,\n            Issuer: vec![],\n        }),\n        Signature: vec![],\n    };\n    let mut bytes = vec![];\n    let mut writer = Writer::new(\u0026mut bytes);\n    broken_cert.write_message(\u0026mut writer).unwrap();\n\n    deserialize_nebula_certificate(\u0026bytes).unwrap_err();\n\n    assert!(deserialize_nebula_certificate_from_pem(\u0026[0u8; 32]).is_err());\n}\n\n#[test]\nfn x25519_serialization() {\n    let bytes = [0u8; 32];\n    assert_eq!(deserialize_x25519_private(\u0026serialize_x25519_private(\u0026bytes)).unwrap(), bytes);\n    assert!(deserialize_x25519_private(\u0026[0u8; 32]).is_err());\n    assert_eq!(deserialize_x25519_public(\u0026serialize_x25519_public(\u0026bytes)).unwrap(), bytes);\n    assert!(deserialize_x25519_public(\u0026[0u8; 32]).is_err());\n}\n\n#[test]\nfn ed25519_serialization() {\n    let bytes = [0u8; 32];\n    assert_eq!(deserialize_ed25519_private(\u0026serialize_ed25519_private(\u0026bytes)).unwrap(), bytes);\n    assert!(deserialize_ed25519_private(\u0026[0u8; 32]).is_err());\n    assert_eq!(deserialize_ed25519_public(\u0026serialize_ed25519_public(\u0026bytes)).unwrap(), bytes);\n    assert!(deserialize_ed25519_public(\u0026[0u8; 32]).is_err());\n}\n\n#[test]\nfn cert_verify() {\n    let (ca_cert, ca_key, _ca_pub) = test_ca_cert(round_systime_to_secs(SystemTime::now()).unwrap(), round_systime_to_secs(SystemTime::now() + Duration::from_secs(60 * 60 * 10)).unwrap(), vec![], vec![], vec![\"groupa\".to_string()]);\n\n    let (cert, _, _) = test_cert(\u0026ca_cert, \u0026ca_key, SystemTime::now(), round_systime_to_secs(SystemTime::now() + Duration::from_secs(60 * 60 * 5)).unwrap(), vec![], vec![], vec![]);\n\n    let mut ca_pool = NebulaCAPool::new();\n    ca_pool.add_ca_certificate(\u0026ca_cert.serialize_to_pem().unwrap()).unwrap();\n\n    let fingerprint = cert.sha256sum().unwrap();\n    ca_pool.blocklist_fingerprint(\u0026fingerprint);\n\n    assert!(matches!(cert.verify(SystemTime::now(), \u0026ca_pool).unwrap(), CertificateValidity::Blocklisted));\n\n    ca_pool.reset_blocklist();\n\n    assert!(matches!(cert.verify(SystemTime::now() + Duration::from_secs(60 * 60 * 60), \u0026ca_pool).unwrap(), CertificateValidity::RootCertExpired));\n    assert!(matches!(cert.verify(SystemTime::now() + Duration::from_secs(60 * 60 * 6), \u0026ca_pool).unwrap(), CertificateValidity::CertExpired));\n\n    let (cert_with_bad_group, _, _) = test_cert(\u0026ca_cert, \u0026ca_key, round_systime_to_secs(SystemTime::now()).unwrap(), in_a_minute(), vec![], vec![], vec![\"group-not-present on parent\".to_string()]);\n    assert_eq!(cert_with_bad_group.verify(SystemTime::now(), \u0026ca_pool).unwrap(), CertificateValidity::GroupNotPresentOnSigner);\n\n    let (cert_with_good_group, _, _) = test_cert(\u0026ca_cert, \u0026ca_key, round_systime_to_secs(SystemTime::now()).unwrap(), in_a_minute(), vec![], vec![], vec![\"groupa\".to_string()]);\n    assert_eq!(cert_with_good_group.verify(SystemTime::now(), \u0026ca_pool).unwrap(), CertificateValidity::Ok);\n\n}\n\n#[test]\nfn cert_verify_ip() {\n    let ca_ip_1 = Ipv4Net::from_str(\"10.0.0.0/16\").unwrap();\n    let ca_ip_2 = Ipv4Net::from_str(\"192.168.0.0/24\").unwrap();\n\n    let (ca, ca_key, _ca_pub) = test_ca_cert(round_systime_to_secs(SystemTime::now()).unwrap(), round_systime_to_secs(SystemTime::now() + Duration::from_secs(60 * 60 * 10)).unwrap(), vec![ca_ip_1, ca_ip_2], vec![], vec![]);\n\n    let ca_pem = ca.serialize_to_pem().unwrap();\n\n    let mut ca_pool = NebulaCAPool::new();\n    ca_pool.add_ca_certificate(\u0026ca_pem).unwrap();\n\n    // ip is outside the network\n    let cip1 = netmask!(\"10.1.0.0\", \"255.255.255.0\");\n    let cip2 = netmask!(\"192.198.0.1\", \"255.255.0.0\");\n    let (cert, _, _) = test_cert(\u0026ca, \u0026ca_key, round_systime_to_secs(SystemTime::now()).unwrap(), round_systime_to_secs(SystemTime::now() + Duration::from_secs(60 * 60 * 5)).unwrap(), vec![cip1, cip2], vec![], vec![]);\n\n    assert_eq!(cert.verify(SystemTime::now(), \u0026ca_pool).unwrap(), CertificateValidity::IPNotPresentOnSigner);\n\n    // ip is outside the network - reversed order from above\n    let cip1 = netmask!(\"192.198.0.1\", \"255.255.255.0\");\n    let cip2 = netmask!(\"10.1.0.0\", \"255.255.255.0\");\n    let (cert, _, _) = test_cert(\u0026ca, \u0026ca_key, round_systime_to_secs(SystemTime::now()).unwrap(), round_systime_to_secs(SystemTime::now() + Duration::from_secs(60 * 60 * 5)).unwrap(), vec![cip1, cip2], vec![], vec![]);\n\n    assert_eq!(cert.verify(SystemTime::now(), \u0026ca_pool).unwrap(), CertificateValidity::IPNotPresentOnSigner);\n\n    // ip is within the network but mask is outside\n    let cip1 = netmask!(\"10.0.1.0\", \"255.254.0.0\");\n    let cip2 = netmask!(\"192.168.0.1\", \"255.255.255.0\");\n    let (cert, _, _) = test_cert(\u0026ca, \u0026ca_key, round_systime_to_secs(SystemTime::now()).unwrap(), round_systime_to_secs(SystemTime::now() + Duration::from_secs(60 * 60 * 5)).unwrap(), vec![cip1, cip2], vec![], vec![]);\n\n    assert_eq!(cert.verify(SystemTime::now(), \u0026ca_pool).unwrap(), CertificateValidity::IPNotPresentOnSigner);\n\n    // ip is within the network but mask is outside - reversed order from above\n    let cip1 = netmask!(\"192.168.0.1\", \"255.255.255.0\");\n    let cip2 = netmask!(\"10.0.1.0\", \"255.254.0.0\");\n    let (cert, _, _) = test_cert(\u0026ca, \u0026ca_key, round_systime_to_secs(SystemTime::now()).unwrap(), round_systime_to_secs(SystemTime::now() + Duration::from_secs(60 * 60 * 5)).unwrap(), vec![cip1, cip2], vec![], vec![]);\n\n    assert_eq!(cert.verify(SystemTime::now(), \u0026ca_pool).unwrap(), CertificateValidity::IPNotPresentOnSigner);\n\n    // ip and mask are within the network\n    let cip1 = netmask!(\"10.0.1.0\", \"255.255.0.0\");\n    let cip2 = netmask!(\"192.168.0.1\", \"255.255.255.128\");\n    let (cert, _, _) = test_cert(\u0026ca, \u0026ca_key, round_systime_to_secs(SystemTime::now()).unwrap(), round_systime_to_secs(SystemTime::now() + Duration::from_secs(60 * 60 * 5)).unwrap(), vec![cip1, cip2], vec![], vec![]);\n\n    assert_eq!(cert.verify(SystemTime::now(), \u0026ca_pool).unwrap(), CertificateValidity::Ok);\n\n    // Exact matches\n    let (cert, _, _) = test_cert(\u0026ca, \u0026ca_key, round_systime_to_secs(SystemTime::now()).unwrap(), round_systime_to_secs(SystemTime::now() + Duration::from_secs(60 * 60 * 5)).unwrap(), vec![ca_ip_1, ca_ip_2], vec![], vec![]);\n    assert_eq!(cert.verify(SystemTime::now(), \u0026ca_pool).unwrap(), CertificateValidity::Ok);\n\n    // Exact matches reversed\n    let (cert, _, _) = test_cert(\u0026ca, \u0026ca_key, round_systime_to_secs(SystemTime::now()).unwrap(), round_systime_to_secs(SystemTime::now() + Duration::from_secs(60 * 60 * 5)).unwrap(), vec![ca_ip_2, ca_ip_1], vec![], vec![]);\n    assert_eq!(cert.verify(SystemTime::now(), \u0026ca_pool).unwrap(), CertificateValidity::Ok);\n\n    // Exact matches reversed with just one\n    let (cert, _, _) = test_cert(\u0026ca, \u0026ca_key, round_systime_to_secs(SystemTime::now()).unwrap(), round_systime_to_secs(SystemTime::now() + Duration::from_secs(60 * 60 * 5)).unwrap(), vec![ca_ip_2], vec![], vec![]);\n    assert_eq!(cert.verify(SystemTime::now(), \u0026ca_pool).unwrap(), CertificateValidity::Ok);\n}\n\n#[test]\nfn cert_verify_subnet() {\n    let ca_ip_1 = Ipv4Net::from_str(\"10.0.0.0/16\").unwrap();\n    let ca_ip_2 = Ipv4Net::from_str(\"192.168.0.0/24\").unwrap();\n\n    let (ca, ca_key, _ca_pub) = test_ca_cert(round_systime_to_secs(SystemTime::now()).unwrap(), round_systime_to_secs(SystemTime::now() + Duration::from_secs(60 * 60 * 10)).unwrap(), vec![],vec![ca_ip_1, ca_ip_2], vec![]);\n\n    let ca_pem = ca.serialize_to_pem().unwrap();\n\n    let mut ca_pool = NebulaCAPool::new();\n    ca_pool.add_ca_certificate(\u0026ca_pem).unwrap();\n\n    // ip is outside the network\n    let cip1 = netmask!(\"10.1.0.0\", \"255.255.255.0\");\n    let cip2 = netmask!(\"192.198.0.1\", \"255.255.0.0\");\n    let (cert, _, _) = test_cert(\u0026ca, \u0026ca_key, round_systime_to_secs(SystemTime::now()).unwrap(), round_systime_to_secs(SystemTime::now() + Duration::from_secs(60 * 60 * 5)).unwrap(), vec![],vec![cip1, cip2], vec![]);\n\n    assert_eq!(cert.verify(SystemTime::now(), \u0026ca_pool).unwrap(), CertificateValidity::SubnetNotPresentOnSigner);\n\n    // ip is outside the network - reversed order from above\n    let cip1 = netmask!(\"192.198.0.1\", \"255.255.255.0\");\n    let cip2 = netmask!(\"10.1.0.0\", \"255.255.255.0\");\n    let (cert, _, _) = test_cert(\u0026ca, \u0026ca_key, round_systime_to_secs(SystemTime::now()).unwrap(), round_systime_to_secs(SystemTime::now() + Duration::from_secs(60 * 60 * 5)).unwrap(), vec![],vec![cip1, cip2], vec![]);\n\n    assert_eq!(cert.verify(SystemTime::now(), \u0026ca_pool).unwrap(), CertificateValidity::SubnetNotPresentOnSigner);\n\n    // ip is within the network but mask is outside\n    let cip1 = netmask!(\"10.0.1.0\", \"255.254.0.0\");\n    let cip2 = netmask!(\"192.168.0.1\", \"255.255.255.0\");\n    let (cert, _, _) = test_cert(\u0026ca, \u0026ca_key, round_systime_to_secs(SystemTime::now()).unwrap(), round_systime_to_secs(SystemTime::now() + Duration::from_secs(60 * 60 * 5)).unwrap(), vec![],vec![cip1, cip2], vec![]);\n\n    assert_eq!(cert.verify(SystemTime::now(), \u0026ca_pool).unwrap(), CertificateValidity::SubnetNotPresentOnSigner);\n\n    // ip is within the network but mask is outside - reversed order from above\n    let cip1 = netmask!(\"192.168.0.1\", \"255.255.255.0\");\n    let cip2 = netmask!(\"10.0.1.0\", \"255.254.0.0\");\n    let (cert, _, _) = test_cert(\u0026ca, \u0026ca_key, round_systime_to_secs(SystemTime::now()).unwrap(), round_systime_to_secs(SystemTime::now() + Duration::from_secs(60 * 60 * 5)).unwrap(), vec![cip1, cip2], vec![], vec![]);\n\n    assert_eq!(cert.verify(SystemTime::now(), \u0026ca_pool).unwrap(), CertificateValidity::SubnetNotPresentOnSigner);\n\n    // ip and mask are within the network\n    let cip1 = netmask!(\"10.0.1.0\", \"255.255.0.0\");\n    let cip2 = netmask!(\"192.168.0.1\", \"255.255.255.128\");\n    let (cert, _, _) = test_cert(\u0026ca, \u0026ca_key, round_systime_to_secs(SystemTime::now()).unwrap(), round_systime_to_secs(SystemTime::now() + Duration::from_secs(60 * 60 * 5)).unwrap(), vec![], vec![cip1, cip2], vec![]);\n\n    assert_eq!(cert.verify(SystemTime::now(), \u0026ca_pool).unwrap(), CertificateValidity::Ok);\n\n    // Exact matches\n    let (cert, _, _) = test_cert(\u0026ca, \u0026ca_key, round_systime_to_secs(SystemTime::now()).unwrap(), round_systime_to_secs(SystemTime::now() + Duration::from_secs(60 * 60 * 5)).unwrap(), vec![],vec![ca_ip_1, ca_ip_2], vec![]);\n    assert_eq!(cert.verify(SystemTime::now(), \u0026ca_pool).unwrap(), CertificateValidity::Ok);\n\n    // Exact matches reversed\n    let (cert, _, _) = test_cert(\u0026ca, \u0026ca_key, round_systime_to_secs(SystemTime::now()).unwrap(), round_systime_to_secs(SystemTime::now() + Duration::from_secs(60 * 60 * 5)).unwrap(), vec![], vec![ca_ip_2, ca_ip_1], vec![]);\n    assert_eq!(cert.verify(SystemTime::now(), \u0026ca_pool).unwrap(), CertificateValidity::Ok);\n\n    // Exact matches reversed with just one\n    let (cert, _, _) = test_cert(\u0026ca, \u0026ca_key, round_systime_to_secs(SystemTime::now()).unwrap(), round_systime_to_secs(SystemTime::now() + Duration::from_secs(60 * 60 * 5)).unwrap(), vec![], vec![ca_ip_2], vec![]);\n    assert_eq!(cert.verify(SystemTime::now(), \u0026ca_pool).unwrap(), CertificateValidity::Ok);\n}\n\n#[test]\nfn cert_private_key() {\n    let (ca, ca_key, _) = test_ca_cert(SystemTime::now(), SystemTime::now(), vec![], vec![], vec![]);\n    ca.verify_private_key(\u0026ca_key.to_keypair_bytes()).unwrap();\n\n    let (_, ca_key2, _) = test_ca_cert(SystemTime::now(), SystemTime::now(), vec![], vec![], vec![]);\n    ca.verify_private_key(\u0026ca_key2.to_keypair_bytes()).unwrap_err();\n\n    let (cert, priv_key, _) = test_cert(\u0026ca, \u0026ca_key, SystemTime::now(), SystemTime::now(), vec![], vec![], vec![]);\n    cert.verify_private_key(\u0026priv_key.to_bytes()).unwrap();\n\n    let (cert2, _, _) = test_cert(\u0026ca, \u0026ca_key, SystemTime::now(), SystemTime::now(), vec![], vec![], vec![]);\n    cert2.verify_private_key(\u0026priv_key.to_bytes()).unwrap_err();\n}\n\n#[macro_export]\nmacro_rules! netmask {\n    ($ip:expr,$mask:expr) =\u003e {\n        Ipv4Net::with_netmask(Ipv4Addr::from_str($ip).unwrap(), Ipv4Addr::from_str($mask).unwrap()).unwrap()\n    };\n}\n\nfn round_systime_to_secs(time: SystemTime) -\u003e Result\u003cSystemTime, SystemTimeError\u003e {\n    let secs = time.duration_since(UNIX_EPOCH)?.as_secs();\n    Ok(SystemTime::UNIX_EPOCH.add(Duration::from_secs(secs)))\n}\n\nfn test_ca_cert(before: SystemTime, after: SystemTime, ips: Vec\u003cIpv4Net\u003e, subnets: Vec\u003cIpv4Net\u003e, groups: Vec\u003cString\u003e) -\u003e (NebulaCertificate, SigningKey, VerifyingKey) {\n    let mut csprng = OsRng;\n    let key = SigningKey::generate(\u0026mut csprng);\n    let pub_key = key.verifying_key();\n\n    let mut cert = NebulaCertificate {\n        details: NebulaCertificateDetails {\n            name: \"TEST_CA\".to_string(),\n            ips,\n            subnets,\n            groups,\n            not_before: before,\n            not_after: after,\n            public_key: pub_key.to_bytes(),\n            is_ca: true,\n            issuer: \"\".to_string(),\n        },\n        signature: vec![],\n    };\n    cert.sign(\u0026key).unwrap();\n    (cert, key, pub_key)\n}\n\nfn test_cert(ca: \u0026NebulaCertificate, key: \u0026SigningKey, before: SystemTime, after: SystemTime, ips: Vec\u003cIpv4Net\u003e, subnets: Vec\u003cIpv4Net\u003e, groups: Vec\u003cString\u003e) -\u003e (NebulaCertificate, SigningKey, VerifyingKey) {\n    let issuer = ca.sha256sum().unwrap();\n\n    let real_groups = if groups.is_empty() {\n        vec![\"test-group1\".to_string(), \"test-group2\".to_string(), \"test-group3\".to_string()]\n    } else {\n        groups\n    };\n\n    let real_ips = if ips.is_empty() {\n        vec![\n            netmask!(\"10.1.1.1\", \"255.255.255.0\"),\n            netmask!(\"10.1.1.2\", \"255.255.0.0\"),\n            netmask!(\"10.1.1.3\", \"255.0.0.0\")\n        ]\n    } else {\n        ips\n    };\n\n    let real_subnets = if subnets.is_empty() {\n        vec![\n            netmask!(\"9.1.1.1\", \"255.255.255.128\"),\n            netmask!(\"9.1.1.2\", \"255.255.255.0\"),\n            netmask!(\"9.1.1.3\", \"255.255.0.0\")\n        ]\n    } else {\n        subnets\n    };\n\n    let mut csprng = OsRng;\n    let cert_key = SigningKey::generate(\u0026mut csprng);\n    let pub_key = cert_key.verifying_key();\n\n    let mut cert = NebulaCertificate {\n        details: NebulaCertificateDetails {\n            name: \"TEST_CA\".to_string(),\n            ips: real_ips,\n            subnets: real_subnets,\n            groups: real_groups,\n            not_before: before,\n            not_after: after,\n            public_key: pub_key.to_bytes(),\n            is_ca: false,\n            issuer,\n        },\n        signature: vec![],\n    };\n    cert.sign(key).unwrap();\n    (cert, cert_key, pub_key)\n}\n\n#[allow(dead_code)]\nfn in_a_minute() -\u003e SystemTime {\n    round_systime_to_secs(SystemTime::now().add(Duration::from_secs(60))).unwrap()\n}\n#[allow(dead_code)]\nfn a_minute_ago() -\u003e SystemTime {\n    round_systime_to_secs(SystemTime::now().sub(Duration::from_secs(60))).unwrap()\n}","traces":[],"covered":0,"coverable":0}]};
-        var previousData = {"files":[{"path":["/","home","core","prj","e3t","trifid","tfclient","src","main.rs"],"content":"fn main() {\n    println!(\"Hello, world!\");\n}\n","traces":[],"covered":0,"coverable":0},{"path":["/","home","core","prj","e3t","trifid","trifid-api","build.rs"],"content":"// generated by `sqlx migrate build-script`\nfn main() {\n    // trigger recompilation when a new migration is added\n    println!(\"cargo:rerun-if-changed=migrations\");\n}","traces":[],"covered":0,"coverable":0},{"path":["/","home","core","prj","e3t","trifid","trifid-api","src","auth.rs"],"content":"use rocket::http::Status;\nuse rocket::{Request};\nuse rocket::request::{FromRequest, Outcome};\nuse crate::tokens::{validate_auth_token, validate_session_token};\n\npub struct PartialUserInfo {\n    pub user_id: i32,\n    pub created_at: i64,\n    pub email: String,\n    pub has_totp_auth: bool,\n\n    pub session_id: String,\n    pub auth_id: Option\u003cString\u003e\n}\n\n#[derive(Debug)]\npub enum AuthenticationError {\n    MissingToken,\n    InvalidToken(usize),\n    DatabaseError,\n    RequiresTOTP\n}\n\n#[rocket::async_trait]\nimpl\u003c'r\u003e FromRequest\u003c'r\u003e for PartialUserInfo {\n    type Error = AuthenticationError;\n\n    async fn from_request(req: \u0026'r Request\u003c'_\u003e) -\u003e Outcome\u003cSelf, Self::Error\u003e {\n        let headers = req.headers();\n\n        // make sure the bearer token exists\n        if let Some(authorization) = headers.get_one(\"Authorization\") {\n            // parse bearer token\n            let components = authorization.split(' ').collect::\u003cVec\u003c\u0026str\u003e\u003e();\n\n            if components.len() != 2 \u0026\u0026 components.len() != 3 {\n                return Outcome::Failure((Status::Unauthorized, AuthenticationError::MissingToken));\n            }\n\n            if components[0] != \"Bearer\" {\n                return Outcome::Failure((Status::Unauthorized, AuthenticationError::InvalidToken(0)));\n            }\n\n            if components.len() == 2 \u0026\u0026 !components[1].starts_with(\"st-\") {\n                return Outcome::Failure((Status::Unauthorized, AuthenticationError::InvalidToken(1)));\n            }\n\n            let st: String;\n            let user_id: i64;\n            let at: Option\u003cString\u003e;\n\n            match \u0026components[1][..3] {\n                \"st-\" =\u003e {\n                    // validate session token\n                    st = components[1].to_string();\n                    match validate_session_token(st.clone(), req.rocket().state().unwrap()).await {\n                        Ok(uid) =\u003e user_id = uid,\n                        Err(_) =\u003e return Outcome::Failure((Status::Unauthorized, AuthenticationError::InvalidToken(2)))\n                    }\n                },\n                _ =\u003e return Outcome::Failure((Status::Unauthorized, AuthenticationError::InvalidToken(3)))\n            }\n\n            if components.len() == 3 {\n                match \u0026components[2][..3] {\n                    \"at-\" =\u003e {\n                        // validate auth token\n                        at = Some(components[2].to_string());\n                        match validate_auth_token(at.clone().unwrap().clone(), st.clone(), req.rocket().state().unwrap()).await {\n                            Ok(_) =\u003e (),\n                            Err(_) =\u003e return Outcome::Failure((Status::Unauthorized, AuthenticationError::InvalidToken(4)))\n                        }\n                    },\n                    _ =\u003e return Outcome::Failure((Status::Unauthorized, AuthenticationError::InvalidToken(5)))\n                }\n            } else {\n                at = None;\n            }\n\n            // this user is 100% valid and authenticated, fetch their info\n\n            let user = match sqlx::query!(\"SELECT * FROM users WHERE id = $1\", user_id.clone() as i32).fetch_one(req.rocket().state().unwrap()).await {\n                Ok(u) =\u003e u,\n                Err(_) =\u003e return Outcome::Failure((Status::InternalServerError, AuthenticationError::DatabaseError))\n            };\n\n            Outcome::Success(PartialUserInfo {\n                user_id: user_id as i32,\n                created_at: user.created_on as i64,\n                email: user.email,\n                has_totp_auth: at.is_some(),\n                session_id: st,\n                auth_id: at,\n            })\n        } else {\n            Outcome::Failure((Status::Unauthorized, AuthenticationError::MissingToken))\n        }\n    }\n}\n\npub struct TOTPAuthenticatedUserInfo {\n    pub user_id: i32,\n    pub created_at: i64,\n    pub email: String,\n}\n#[rocket::async_trait]\nimpl\u003c'r\u003e FromRequest\u003c'r\u003e for TOTPAuthenticatedUserInfo {\n    type Error = AuthenticationError;\n\n    async fn from_request(request: \u0026'r Request\u003c'_\u003e) -\u003e Outcome\u003cSelf, Self::Error\u003e {\n        let userinfo = PartialUserInfo::from_request(request).await;\n        match userinfo {\n            Outcome::Failure(e) =\u003e Outcome::Failure(e),\n            Outcome::Forward(f) =\u003e Outcome::Forward(f),\n            Outcome::Success(s) =\u003e {\n                if s.has_totp_auth {\n                    Outcome::Success(Self {\n                        user_id: s.user_id,\n                        created_at: s.created_at,\n                        email: s.email,\n                    })\n                } else {\n                    Outcome::Failure((Status::Unauthorized, AuthenticationError::RequiresTOTP))\n                }\n            }\n        }\n    }\n}","traces":[{"line":28,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":29,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":32,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":34,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":36,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":37,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":40,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":41,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":44,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":45,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":48,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":49,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":50,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":52,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":53,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":55,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":56,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":57,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":58,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":61,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":64,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":65,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":66,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":68,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":69,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":70,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":71,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":74,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":77,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":82,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":83,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":84,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":87,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":88,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":89,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":90,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":91,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":92,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":93,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":96,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":110,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":111,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":112,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":113,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":114,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":115,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":116,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":117,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":118,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":119,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":120,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":123,"address":[],"length":0,"stats":{"Line":0},"fn_name":null}],"covered":0,"coverable":52},{"path":["/","home","core","prj","e3t","trifid","trifid-api","src","config.rs"],"content":"use serde::Deserialize;\nuse url::Url;\n\n#[derive(Deserialize)]\npub struct TFConfig {\n    pub listen_port: u16,\n    pub db_url: String,\n    pub base: Url,\n    pub web_root: Url,\n    pub magic_links_valid_for: i64,\n    pub session_tokens_valid_for: i64,\n    pub totp_verification_valid_for: i64,\n    pub data_key: String\n}","traces":[],"covered":0,"coverable":0},{"path":["/","home","core","prj","e3t","trifid","trifid-api","src","crypto.rs"],"content":"use std::error::Error;\nuse aes_gcm::{Aes256Gcm, KeyInit, Nonce};\nuse aes_gcm::aead::{Aead, Payload};\nuse crate::config::TFConfig;\n\npub fn get_cipher_from_config(config: \u0026TFConfig) -\u003e Result\u003cAes256Gcm, Box\u003cdyn Error\u003e\u003e {\n    let key_slice = hex::decode(\u0026config.data_key)?;\n    Ok(Aes256Gcm::new_from_slice(\u0026key_slice)?)\n}\n\npub fn encrypt_with_nonce(plaintext: \u0026[u8], nonce: [u8; 12], cipher: \u0026Aes256Gcm) -\u003e Result\u003cVec\u003cu8\u003e, aes_gcm::Error\u003e {\n    let nonce = Nonce::from_slice(\u0026nonce);\n    let ciphertext = cipher.encrypt(nonce, plaintext)?;\n    Ok(ciphertext)\n}\n\npub fn decrypt_with_nonce(ciphertext: \u0026[u8], nonce: [u8; 12], cipher: \u0026Aes256Gcm) -\u003e Result\u003cVec\u003cu8\u003e, aes_gcm::Error\u003e {\n    let nonce = Nonce::from_slice(\u0026nonce);\n    let plaintext = cipher.decrypt(nonce, Payload::from(ciphertext))?;\n    Ok(plaintext)\n}","traces":[],"covered":0,"coverable":0},{"path":["/","home","core","prj","e3t","trifid","trifid-api","src","db.rs"],"content":"","traces":[],"covered":0,"coverable":0},{"path":["/","home","core","prj","e3t","trifid","trifid-api","src","format.rs"],"content":"use std::fmt::{Display, Formatter};\nuse crate::format::PEMValidationError::{IncorrectSegmentLength, InvalidBase64Data, MissingStartSentinel};\nuse crate::util::base64decode;\n\npub const ED_PUBKEY_START_STR: \u0026str = \"-----BEGIN NEBULA ED25519 PUBLIC KEY-----\";\npub const ED_PUBKEY_END_STR: \u0026str = \"-----END NEBULA ED25519 PUBLIC KEY-----\";\n\npub const DH_PUBKEY_START_STR: \u0026str = \"-----BEGIN NEBULA X25519 PUBLIC KEY-----\";\npub const DH_PUBKEY_END_STR: \u0026str = \"-----END NEBULA X25519 PUBLIC KEY-----\";\n\npub enum PEMValidationError {\n    MissingStartSentinel,\n    InvalidBase64Data,\n    MissingEndSentinel,\n    IncorrectSegmentLength(usize, usize)\n}\nimpl Display for PEMValidationError {\n    fn fmt(\u0026self, f: \u0026mut Formatter\u003c'_\u003e) -\u003e std::fmt::Result {\n        match self {\n            Self::MissingEndSentinel =\u003e write!(f, \"Missing ending sentinel\"),\n            Self::MissingStartSentinel =\u003e write!(f, \"Missing starting sentinel\"),\n            Self::InvalidBase64Data =\u003e write!(f, \"invalid base64 data\"),\n            Self::IncorrectSegmentLength(expected, got) =\u003e write!(f, \"incorrect number of segments, expected {} got {}\", expected, got)\n        }\n    }\n}\n\npub fn validate_ed_pubkey_pem(pubkey: \u0026str) -\u003e Result\u003c(), PEMValidationError\u003e {\n    let segments = pubkey.split('\\n');\n    let segs = segments.collect::\u003cVec\u003c\u0026str\u003e\u003e();\n    if segs.len() \u003c 3 {\n        return Err(IncorrectSegmentLength(3, segs.len()))\n    }\n    if segs[0] != ED_PUBKEY_START_STR {\n        return Err(MissingStartSentinel)\n    }\n    if base64decode(segs[1]).is_err() {\n        return Err(InvalidBase64Data)\n    }\n    if segs[2] != ED_PUBKEY_END_STR {\n        return Err(MissingStartSentinel)\n    }\n    Ok(())\n}\n\npub fn validate_dh_pubkey_pem(pubkey: \u0026str) -\u003e Result\u003c(), PEMValidationError\u003e {\n    let segments = pubkey.split('\\n');\n    let segs = segments.collect::\u003cVec\u003c\u0026str\u003e\u003e();\n    if segs.len() \u003c 3 {\n        return Err(IncorrectSegmentLength(3, segs.len()))\n    }\n    if segs[0] != DH_PUBKEY_START_STR {\n        return Err(MissingStartSentinel)\n    }\n    if base64decode(segs[1]).is_err() {\n        return Err(InvalidBase64Data)\n    }\n    if segs[2] != DH_PUBKEY_END_STR {\n        return Err(MissingStartSentinel)\n    }\n    Ok(())\n}\n\npub fn validate_ed_pubkey_base64(pubkey: \u0026str) -\u003e Result\u003c(), PEMValidationError\u003e {\n    match base64decode(pubkey) {\n        Ok(k) =\u003e validate_ed_pubkey_pem(match std::str::from_utf8(k.as_ref()) {\n            Ok(k) =\u003e k,\n            Err(_) =\u003e return Err(InvalidBase64Data)\n        }),\n        Err(_) =\u003e Err(InvalidBase64Data)\n    }\n}\n\npub fn validate_dh_pubkey_base64(pubkey: \u0026str) -\u003e Result\u003c(), PEMValidationError\u003e {\n    match base64decode(pubkey) {\n        Ok(k) =\u003e validate_dh_pubkey_pem(match std::str::from_utf8(k.as_ref()) {\n            Ok(k) =\u003e k,\n            Err(_) =\u003e return Err(InvalidBase64Data)\n        }),\n        Err(_) =\u003e Err(InvalidBase64Data)\n    }\n}","traces":[],"covered":0,"coverable":0},{"path":["/","home","core","prj","e3t","trifid","trifid-api","src","main.rs"],"content":"extern crate core;\n\nuse std::error::Error;\nuse std::fs;\nuse std::path::Path;\nuse dotenvy::dotenv;\nuse log::{error, info};\nuse rocket::{catchers, Request, Response, routes};\nuse rocket::fairing::{Fairing, Info, Kind};\nuse rocket::http::Header;\nuse sqlx::migrate::Migrator;\nuse sqlx::postgres::PgPoolOptions;\nuse crate::config::TFConfig;\n\npub mod format;\npub mod util;\npub mod db;\npub mod config;\npub mod tokens;\npub mod routes;\npub mod auth;\npub mod crypto;\npub mod org;\n\nstatic MIGRATOR: Migrator = sqlx::migrate!();\n\npub struct CORS;\n\n#[rocket::async_trait]\nimpl Fairing for CORS {\n    fn info(\u0026self) -\u003e Info {\n        Info {\n            name: \"Add CORS headers to responses\",\n            kind: Kind::Response\n        }\n    }\n\n    async fn on_response\u003c'r\u003e(\u0026self, _request: \u0026'r Request\u003c'_\u003e, response: \u0026mut Response\u003c'r\u003e) {\n        response.set_header(Header::new(\"Access-Control-Allow-Origin\", \"*\"));\n        response.set_header(Header::new(\"Access-Control-Allow-Methods\", \"POST, GET, PATCH, OPTIONS\"));\n        response.set_header(Header::new(\"Access-Control-Allow-Headers\", \"*\"));\n        response.set_header(Header::new(\"Access-Control-Allow-Credentials\", \"true\"));\n    }\n}\n\n#[rocket::main]\nasync fn main() -\u003e Result\u003c(), Box\u003cdyn Error\u003e\u003e {\n    let _ = rocket::build();\n\n    info!(\"[tfapi] loading config\");\n\n    let _ = dotenv();\n\n    if std::env::var(\"CONFIG_FILE\").is_err() \u0026\u0026 !Path::new(\"config.toml\").exists() {\n        error!(\"[tfapi] fatal: the environment variable CONFIG_FILE is not set\");\n        error!(\"[tfapi]  help: try creating a .env file that sets it\");\n        error!(\"[tfapi]  help: or, create a file config.toml with your config, as it is loaded automatically\");\n        std::process::exit(1);\n    }\n\n    let config_file = if Path::new(\"config.toml\").exists() {\n        \"config.toml\".to_string()\n    } else {\n        std::env::var(\"CONFIG_FILE\").unwrap()\n    };\n\n    let config_data = match fs::read_to_string(\u0026config_file) {\n        Ok(d) =\u003e d,\n        Err(e) =\u003e {\n            error!(\"[tfapi] fatal: unable to read config from {}\", config_file);\n            error!(\"[tfapi] fatal: {}\", e);\n            std::process::exit(1);\n        }\n    };\n\n    let config: TFConfig = match toml::from_str(\u0026config_data) {\n        Ok(c) =\u003e c,\n        Err(e) =\u003e {\n            error!(\"[tfapi] fatal: unable to parse config from {}\", config_file);\n            error!(\"[tfapi] fatal: {}\", e);\n            std::process::exit(1);\n        }\n    };\n\n    info!(\"[tfapi] connecting to database pool\");\n\n    let pool = match PgPoolOptions::new().max_connections(5).connect(\u0026config.db_url).await {\n        Ok(p) =\u003e p,\n        Err(e) =\u003e {\n            error!(\"[tfapi] fatal: unable to connect to database pool\");\n            error!(\"[tfapi] fatal: {}\", e);\n            std::process::exit(1);\n        }\n    };\n\n    info!(\"[tfapi] running database migrations\");\n\n    MIGRATOR.run(\u0026pool).await?;\n\n    info!(\"[tfapi] building rocket config\");\n\n    let figment = rocket::Config::figment().merge((\"port\", config.listen_port));\n\n    let _ = rocket::custom(figment)\n        .mount(\"/\", routes![\n            crate::routes::v1::auth::magic_link::magiclink_request,\n            crate::routes::v1::auth::magic_link::options,\n            crate::routes::v1::signup::signup_request,\n            crate::routes::v1::signup::options,\n            crate::routes::v1::auth::verify_magic_link::verify_magic_link,\n            crate::routes::v1::auth::verify_magic_link::options,\n            crate::routes::v1::totp_authenticators::totp_authenticators_request,\n            crate::routes::v1::totp_authenticators::options,\n            crate::routes::v1::verify_totp_authenticator::verify_totp_authenticator_request,\n            crate::routes::v1::verify_totp_authenticator::options,\n            crate::routes::v1::auth::totp::totp_request,\n            crate::routes::v1::auth::totp::options,\n            crate::routes::v1::auth::check_session::check_session,\n            crate::routes::v1::auth::check_session::check_session_auth,\n            crate::routes::v1::auth::check_session::options,\n            crate::routes::v1::auth::check_session::options_auth,\n            crate::routes::v2::whoami::whoami_request,\n            crate::routes::v2::whoami::options,\n\n            crate::routes::v1::organization::options,\n            crate::routes::v1::organization::orgidoptions,\n            crate::routes::v1::organization::orginfo_req,\n            crate::routes::v1::organization::orglist_req,\n            crate::routes::v1::organization::create_org\n        ])\n        .register(\"/\", catchers![\n            crate::routes::handler_400,\n            crate::routes::handler_401,\n            crate::routes::handler_403,\n            crate::routes::handler_404,\n            crate::routes::handler_422,\n\n            crate::routes::handler_500,\n            crate::routes::handler_501,\n            crate::routes::handler_502,\n            crate::routes::handler_503,\n            crate::routes::handler_504,\n            crate::routes::handler_505,\n        ])\n        .attach(CORS)\n        .manage(pool)\n        .manage(config)\n        .launch().await?;\n\n    Ok(())\n}","traces":[{"line":38,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":39,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":40,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":41,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":42,"address":[],"length":0,"stats":{"Line":0},"fn_name":null}],"covered":0,"coverable":5},{"path":["/","home","core","prj","e3t","trifid","trifid-api","src","org.rs"],"content":"use std::error::Error;\nuse rocket::form::validate::Contains;\nuse sqlx::PgPool;\n\npub async fn get_org_by_owner_id(user: i32, db: \u0026PgPool) -\u003e Result\u003cOption\u003ci32\u003e, Box\u003cdyn Error\u003e\u003e {\n    Ok(match sqlx::query!(\"SELECT id FROM organizations WHERE owner = $1\", user).fetch_optional(db).await? {\n        Some(r) =\u003e Some(r.id),\n        None =\u003e None\n    })\n}\n\npub async fn get_orgs_by_assoc_id(user: i32, db: \u0026PgPool) -\u003e Result\u003cVec\u003ci32\u003e, Box\u003cdyn Error\u003e\u003e {\n    let res: Vec\u003c_\u003e = sqlx::query!(\"SELECT org_id FROM organization_authorized_users WHERE user_id = $1\", user).fetch_all(db).await?;\n\n    let mut ret = vec![];\n\n    for i in res {\n        ret.push(i.org_id);\n    }\n\n    Ok(ret)\n}\n\npub async fn get_users_by_assoc_org(org: i32, db: \u0026PgPool) -\u003e Result\u003cVec\u003ci32\u003e, Box\u003cdyn Error\u003e\u003e {\n    let res: Vec\u003c_\u003e = sqlx::query!(\"SELECT user_id FROM organization_authorized_users WHERE org_id = $1\", org).fetch_all(db).await?;\n\n    let mut ret = vec![];\n\n    for i in res {\n        ret.push(i.org_id);\n    }\n\n    Ok(ret)\n}\n\npub async fn get_associated_orgs(user: i32, db: \u0026PgPool) -\u003e Result\u003cVec\u003ci32\u003e, Box\u003cdyn Error\u003e\u003e {\n    let mut assoc_orgs = vec![];\n\n    if let Some(owned_org) = get_org_by_owner_id(user, db).await? {\n        assoc_orgs.push(owned_org);\n    }\n\n    assoc_orgs.append(\u0026mut get_orgs_by_assoc_id(user, db).await?);\n\n    Ok(assoc_orgs)\n}\n\npub async fn user_has_org_assoc(user: i32, org: i32, db: \u0026PgPool) -\u003e Result\u003cbool, Box\u003cdyn Error\u003e\u003e {\n    Ok(get_associated_orgs(user, db).await?.contains(org))\n}","traces":[],"covered":0,"coverable":0},{"path":["/","home","core","prj","e3t","trifid","trifid-api","src","routes","mod.rs"],"content":"pub mod v1;\npub mod v2;\n\nuse rocket::catch;\nuse serde::{Serialize};\nuse rocket::http::Status;\n\npub const ERR_MSG_MALFORMED_REQUEST: \u0026str = \"unable to parse the request body - is it valid JSON, using correct types?\";\npub const ERR_MSG_MALFORMED_REQUEST_CODE: \u0026str = \"ERR_MALFORMED_REQUEST\";\n\n/*\nTODO:\n    /v1/auth/magic-link                         [done]\n    /v1/auth/totp                               [done]\n    /v1/auth/verify-magic-link                  [done]\n    /v1/hosts/host-{id}/enrollment-code\n    /v1/hosts/host-{id}/enrollment-code-check\n    /v1/hosts/host-{id}\n    /v1/roles/role-{id}\n    /v1/feature-flags\n    /v1/hosts\n    /v1/networks\n    /v1/roles\n    /v1/signup                                  [done]\n    /v1/totp-authenticators                     [done]\n    /v1/verify-totp-authenticator               [done]\n    /v1/dnclient\n    /v2/enroll\n    /v2/whoami                                  [in-progress]\n */\n\n#[derive(Serialize)]\n#[serde(crate = \"rocket::serde\")]\npub struct APIError {\n    errors: Vec\u003cAPIErrorSingular\u003e\n}\n#[derive(Serialize)]\n#[serde(crate = \"rocket::serde\")]\npub struct APIErrorSingular {\n    code: String,\n    message: String\n}\n\nmacro_rules! error_handler {\n    ($code: expr, $err: expr, $msg: expr) =\u003e {\n        ::paste::paste! {\n            #[catch($code)]\n            pub fn [\u003chandler_ $code\u003e]() -\u003e (Status, String) {\n                (Status::from_code($code).unwrap(), format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{}\\\"}}]}}\", $err, $msg))\n            }\n        }\n    };\n}\nerror_handler!(400, \"ERR_MALFORMED_REQUEST\", \"unable to parse the request body, is it properly formatted?\");\nerror_handler!(401, \"ERR_AUTHENTICATION_REQUIRED\", \"this endpoint requires authentication but it was not provided\");\nerror_handler!(403, \"ERR_UNAUTHORIZED\", \"authorization was provided but it is expired or invalid\");\nerror_handler!(404, \"ERR_NOT_FOUND\", \"resource not found\");\nerror_handler!(405, \"ERR_METHOD_NOT_ALLOWED\", \"method not allowed for this endpoint\");\nerror_handler!(422, \"ERR_MALFORMED_REQUEST\", \"unable to parse the request body, is it properly formatted?\");\n\nerror_handler!(500, \"ERR_QL_QUERY_FAILED\", \"graphql query timed out\");\nerror_handler!(501, \"ERR_NOT_IMPLEMENTED\", \"query not supported by this version of graphql\");\nerror_handler!(502, \"ERR_PROXY_ERR\", \"servers under load, please try again later\");\nerror_handler!(503, \"ERR_SERVER_OVERLOADED\", \"servers under load, please try again later\");\nerror_handler!(504, \"ERR_PROXY_TIMEOUT\", \"servers under load, please try again later\");\nerror_handler!(505, \"ERR_CLIENT_UNSUPPORTED\", \"your version of dnclient is out of date, please update\");\n","traces":[],"covered":0,"coverable":0},{"path":["/","home","core","prj","e3t","trifid","trifid-api","src","routes","v1","auth","check_session.rs"],"content":"use rocket::{post, options};\nuse crate::auth::{PartialUserInfo, TOTPAuthenticatedUserInfo};\n\n#[options(\"/v1/auth/check_session\")]\npub async fn options() -\u003e \u0026'static str {\n    \"\"\n}\n\n#[post(\"/v1/auth/check_session\")]\npub async fn check_session(_user: PartialUserInfo) -\u003e \u0026'static str {\n    \"ok\"\n}\n\n#[options(\"/v1/auth/check_auth\")]\npub async fn options_auth() -\u003e \u0026'static str {\n    \"\"\n}\n\n\n#[post(\"/v1/auth/check_auth\")]\npub async fn check_session_auth(_user: TOTPAuthenticatedUserInfo) -\u003e \u0026'static str {\n    \"ok\"\n}","traces":[],"covered":0,"coverable":0},{"path":["/","home","core","prj","e3t","trifid","trifid-api","src","routes","v1","auth","magic_link.rs"],"content":"use rocket::{post, State};\nuse rocket::serde::json::Json;\nuse serde::{Serialize, Deserialize};\nuse rocket::http::{ContentType, Status};\nuse sqlx::PgPool;\nuse crate::config::TFConfig;\nuse crate::tokens::send_magic_link;\nuse rocket::options;\n\n#[derive(Serialize, Deserialize)]\n#[serde(crate = \"rocket::serde\")]\npub struct MagicLinkRequest {\n    pub email: String,\n}\n\n#[derive(Serialize, Deserialize)]\n#[serde(crate = \"rocket::serde\")]\npub struct MagicLinkResponseMetadata {}\n\n#[derive(Serialize, Deserialize)]\n#[serde(crate = \"rocket::serde\")]\npub struct MagicLinkResponse {\n    pub data: Option\u003cString\u003e,\n    pub metadata: MagicLinkResponseMetadata,\n}\n\n\n#[options(\"/v1/auth/magic-link\")]\npub async fn options() -\u003e \u0026'static str {\n    \"\"\n}\n\n#[post(\"/v1/auth/magic-link\", data = \"\u003creq\u003e\")]\npub async fn magiclink_request(req: Json\u003cMagicLinkRequest\u003e, pool: \u0026State\u003cPgPool\u003e, config: \u0026State\u003cTFConfig\u003e) -\u003e Result\u003c(ContentType, Json\u003cMagicLinkResponse\u003e), (Status, String)\u003e {\n    // figure out if the user already exists\n    let mut id = -1;\n    match sqlx::query!(\"SELECT id FROM users WHERE email = $1\", req.email.clone()).fetch_optional(pool.inner()).await {\n        Ok(res) =\u003e if let Some(r) = res { id = r.id as i64 },\n        Err(e) =\u003e {\n            return Err((Status::InternalServerError, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{} - {}\\\"}}]}}\", \"ERR_QL_QUERY_FAILED\", \"an error occurred while running the graphql query\", e)))\n        }\n    }\n\n    if id == -1 {\n        return Err((Status::Unauthorized, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{}\\\"}}]}}\", \"ERR_UNAUTHORIZED\", \"authorization was provided but it is expired or invalid\")))\n    }\n\n    // send magic link to email\n    match send_magic_link(id, req.email.clone(), pool.inner(), config.inner()).await {\n        Ok(_) =\u003e (),\n        Err(e) =\u003e {\n            return Err((Status::InternalServerError, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{} - {}\\\"}}]}}\", \"ERR_QL_QUERY_FAILED\", \"an error occurred while running the graphql query\", e)))\n        }\n    };\n\n    // this endpoint doesn't actually ever return an error? it will send you the magic link no matter what\n    // this appears to do the exact same thing as /v1/auth/magic-link, but it doesn't check if you have an account (magic-link does)\n    Ok((ContentType::JSON, Json(MagicLinkResponse {\n        data: None,\n        metadata: MagicLinkResponseMetadata {},\n    })))\n}","traces":[],"covered":0,"coverable":0},{"path":["/","home","core","prj","e3t","trifid","trifid-api","src","routes","v1","auth","mod.rs"],"content":"pub mod verify_magic_link;\npub mod magic_link;\npub mod totp;\npub mod check_session;","traces":[],"covered":0,"coverable":0},{"path":["/","home","core","prj","e3t","trifid","trifid-api","src","routes","v1","auth","totp.rs"],"content":"use rocket::http::{ContentType, Status};\nuse rocket::serde::json::Json;\nuse crate::auth::PartialUserInfo;\nuse serde::{Serialize, Deserialize};\nuse rocket::{post, State};\nuse sqlx::PgPool;\nuse rocket::options;\nuse crate::tokens::{generate_auth_token, get_totpmachine, user_has_totp};\n\npub const TOTP_GENERIC_UNAUTHORIZED_ERROR: \u0026str = \"{\\\"errors\\\":[{\\\"code\\\":\\\"ERR_INVALID_TOTP_CODE\\\",\\\"message\\\":\\\"invalid TOTP code (maybe it expired?)\\\",\\\"path\\\":\\\"code\\\"}]}\";\npub const TOTP_NO_TOTP_ERROR: \u0026str = \"{\\\"errors\\\":[{\\\"code\\\":\\\"ERR_NO_TOTP\\\",\\\"message\\\":\\\"logged-in user does not have totp enabled\\\",\\\"path\\\":\\\"code\\\"}]}\";\n\n#[derive(Serialize, Deserialize)]\n#[serde(crate = \"rocket::serde\")]\npub struct TotpRequest {\n    pub code: String\n}\n\n#[derive(Serialize, Deserialize)]\n#[serde(crate = \"rocket::serde\")]\npub struct TotpResponseData {\n    #[serde(rename = \"authToken\")]\n    auth_token: String\n}\n#[derive(Serialize, Deserialize)]\n#[serde(crate = \"rocket::serde\")]\npub struct TotpResponseMetadata {\n}\n#[derive(Serialize, Deserialize)]\n#[serde(crate = \"rocket::serde\")]\npub struct TotpResponse {\n    data: TotpResponseData,\n    metadata: TotpResponseMetadata\n}\n\n#[options(\"/v1/auth/totp\")]\npub async fn options() -\u003e \u0026'static str {\n    \"\"\n}\n\n\n#[post(\"/v1/auth/totp\", data = \"\u003creq\u003e\")]\npub async fn totp_request(req: Json\u003cTotpRequest\u003e, user: PartialUserInfo, db: \u0026State\u003cPgPool\u003e) -\u003e Result\u003c(ContentType, Json\u003cTotpResponse\u003e), (Status, String)\u003e {\n    if !match user_has_totp(user.user_id, db.inner()).await {\n        Ok(b) =\u003e b,\n        Err(e) =\u003e return Err((Status::InternalServerError, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{} - {}\\\"}}]}}\", \"ERR_UNABLE_TO_ISSUE\", \"an error occured trying to issue a session token, please try again later\", e)))\n    } {\n        return Err((Status::UnprocessableEntity, TOTP_NO_TOTP_ERROR.to_string()))\n    }\n\n    if user.has_totp_auth {\n        return Err((Status::BadRequest, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{}\\\"}}]}}\", \"ERR_TOTP_ALREADY_AUTHED\", \"user already has valid totp authentication\")))\n    }\n\n    let totpmachine = match get_totpmachine(user.user_id, db.inner()).await {\n        Ok(t) =\u003e t,\n        Err(e) =\u003e {\n            return Err((Status::InternalServerError, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{} - {}\\\"}}]}}\", \"ERR_UNABLE_TO_ISSUE\", \"an error occured trying to issue a session token, please try again later\", e)))\n        }\n    };\n\n    if !totpmachine.check_current(\u0026req.0.code).unwrap_or(false) {\n        return Err((Status::Unauthorized, TOTP_GENERIC_UNAUTHORIZED_ERROR.to_string()))\n    }\n\n    Ok((ContentType::JSON, Json(TotpResponse {\n        data: TotpResponseData { auth_token: match generate_auth_token(user.user_id as i64, user.session_id, db.inner()).await {\n            Ok(t) =\u003e t,\n            Err(e) =\u003e { return Err((Status::InternalServerError, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{} - {}\\\"}}]}}\", \"ERR_UNABLE_TO_ISSUE\", \"an error occured trying to issue a session token, please try again later\", e))) }\n        } },\n        metadata: TotpResponseMetadata {},\n    })))\n}","traces":[],"covered":0,"coverable":0},{"path":["/","home","core","prj","e3t","trifid","trifid-api","src","routes","v1","auth","verify_magic_link.rs"],"content":"use std::time::{SystemTime, UNIX_EPOCH};\nuse rocket::http::{ContentType, Status};\nuse rocket::serde::json::Json;\nuse serde::{Serialize, Deserialize};\nuse rocket::{post, State};\nuse sqlx::PgPool;\nuse crate::config::TFConfig;\nuse crate::tokens::generate_session_token;\nuse rocket::options;\n\n#[derive(Serialize, Deserialize)]\n#[serde(crate = \"rocket::serde\")]\npub struct VerifyMagicLinkRequest {\n    #[serde(rename = \"magicLinkToken\")]\n    pub magic_link_token: String,\n}\n\n\n#[derive(Serialize, Deserialize)]\npub struct VerifyMagicLinkResponseMetadata {}\n\n#[derive(Serialize, Deserialize)]\npub struct VerifyMagicLinkResponseData {\n    #[serde(rename = \"sessionToken\")]\n    pub session_token: String,\n}\n\n#[derive(Serialize, Deserialize)]\npub struct VerifyMagicLinkResponse {\n    pub data: VerifyMagicLinkResponseData,\n    pub metadata: VerifyMagicLinkResponseMetadata,\n}\n\n#[options(\"/v1/auth/verify-magic-link\")]\npub async fn options() -\u003e \u0026'static str {\n    \"\"\n}\n\n\n#[post(\"/v1/auth/verify-magic-link\", data = \"\u003creq\u003e\")]\npub async fn verify_magic_link(req: Json\u003cVerifyMagicLinkRequest\u003e, db: \u0026State\u003cPgPool\u003e, config: \u0026State\u003cTFConfig\u003e) -\u003e Result\u003c(ContentType, Json\u003cVerifyMagicLinkResponse\u003e), (Status, String)\u003e {\n    // get the current time to check if the token is expired\n    let (user_id, expired_at) = match sqlx::query!(\"SELECT user_id, expires_on FROM magic_links WHERE id = $1\", req.0.magic_link_token).fetch_one(db.inner()).await {\n        Ok(row) =\u003e (row.user_id, row.expires_on),\n        Err(e) =\u003e {\n            return Err((Status::Unauthorized, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{} - {}\\\"}}]}}\", \"ERR_UNAUTHORIZED\", \"this token is invalid\", e)))\n        }\n    };\n    let current_time = SystemTime::now().duration_since(UNIX_EPOCH).unwrap().as_secs() as i32;\n    println!(\"expired on {}, currently {}\", expired_at, current_time);\n    if expired_at \u003c current_time {\n        return Err((Status::Unauthorized, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{}\\\"}}]}}\", \"ERR_UNAUTHORIZED\", \"valid authorization was provided but it is expired\")))\n    }\n\n    // generate session token\n    let token = match generate_session_token(user_id as i64, db.inner(), config.inner()).await {\n        Ok(t) =\u003e t,\n        Err(e) =\u003e {\n            return Err((Status::InternalServerError, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{} - {}\\\"}}]}}\", \"ERR_UNABLE_TO_ISSUE\", \"an error occured trying to issue a session token, please try again later\", e)))\n        }\n    };\n\n    // delete the token\n    match sqlx::query!(\"DELETE FROM magic_links WHERE id = $1\", req.0.magic_link_token).execute(db.inner()).await {\n        Ok(_) =\u003e (),\n        Err(e) =\u003e {\n            return Err((Status::InternalServerError, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{} - {}\\\"}}]}}\", \"ERR_UNABLE_TO_ISSUE\", \"an error occured trying to issue a session token, please try again later\", e)))\n        }\n    }\n\n    Ok((ContentType::JSON, Json(VerifyMagicLinkResponse {\n        data: VerifyMagicLinkResponseData { session_token: token },\n        metadata: VerifyMagicLinkResponseMetadata {},\n    })))\n}","traces":[],"covered":0,"coverable":0},{"path":["/","home","core","prj","e3t","trifid","trifid-api","src","routes","v1","mod.rs"],"content":"pub mod auth;\npub mod signup;\n\npub mod totp_authenticators;\npub mod verify_totp_authenticator;\npub mod organization;","traces":[],"covered":0,"coverable":0},{"path":["/","home","core","prj","e3t","trifid","trifid-api","src","routes","v1","organization.rs"],"content":"use std::slice::from_raw_parts_mut;\nuse rocket::{get, post, options, State};\nuse rocket::http::{ContentType, Status};\nuse rocket::serde::json::Json;\nuse serde::{Serialize, Deserialize};\nuse sqlx::PgPool;\nuse crate::auth::TOTPAuthenticatedUserInfo;\nuse crate::config::TFConfig;\nuse crate::org::{get_associated_orgs, get_org_by_owner_id, get_users_by_assoc_org, user_has_org_assoc};\n\n#[options(\"/v1/orgs\")]\npub fn options() -\u003e \u0026'static str {\n    \"\"\n}\n#[options(\"/v1/org/\u003c_id\u003e\")]\npub fn orgidoptions(_id: i32) -\u003e \u0026'static str {\n    \"\"\n}\n\n#[derive(Serialize, Deserialize)]\n#[serde(crate = \"rocket::serde\")]\npub struct OrglistStruct {\n    pub org_ids: Vec\u003ci32\u003e\n}\n\n\n#[get(\"/v1/orgs\")]\npub async fn orglist_req(user: TOTPAuthenticatedUserInfo, db: \u0026State\u003cPgPool\u003e) -\u003e Result\u003c(ContentType, Json\u003cOrglistStruct\u003e), (Status, String)\u003e {\n    // this endpoint lists the associated organizations this user has access to\n    let associated_orgs = match get_associated_orgs(user.user_id, db.inner()).await {\n        Ok(r) =\u003e r,\n        Err(e) =\u003e return Err((Status::InternalServerError, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{} - {}\\\"}}]}}\", \"ERR_DB_QUERY_FAILED\", \"an error occurred while running the database query\")))\n    };\n\n    Ok((ContentType::JSON, Json(OrglistStruct {\n        org_ids: associated_orgs\n    })))\n}\n\n#[derive(Serialize, Deserialize)]\n#[serde(crate = \"rocket::serde\")]\npub struct OrginfoStruct {\n    pub org_id: i32,\n    pub owner_id: i32,\n    pub ca_crt: String,\n    pub authorized_users: Vec\u003ci32\u003e\n}\n\n#[get(\"/v1/org/\u003corgid\u003e\")]\npub async fn orginfo_req(orgid: i32, user: TOTPAuthenticatedUserInfo, db: \u0026State\u003cPgPool\u003e) -\u003e Result\u003c(ContentType, Json\u003cOrginfoStruct\u003e), (Status, String)\u003e {\n    if !user_has_org_assoc(orgid, user.user_id, db.inner()).await.map_err(|e| (Status::InternalServerError, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{} - {}\\\"}}]}}\", \"ERR_QL_QUERY_FAILED\", \"an error occurred while running the graphql query\", e)))? {\n        return Err((Status::Unauthorized, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{}\\\"}}]}}\", \"ERR_MISSING_ORG_AUTHORIZATION\", \"this user does not have permission to access this org\")));\n    }\n\n    let org = sqlx::query!(\"SELECT id, owner, ca_crt FROM organizations WHERE id = $1\", orgid).fetch_one(orgid).await.map_err(|e| (Status::InternalServerError, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{} - {}\\\"}}]}}\", \"ERR_QL_QUERY_FAILED\", \"an error occurred while running the graphql query\", e)))?;\n    let authorized_users = get_users_by_assoc_org(orgid, db.inner()).await.map_err(|e| (Status::InternalServerError, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{} - {}\\\"}}]}}\", \"ERR_QL_QUERY_FAILED\", \"an error occurred while running the graphql query\", e)))?;\n\n    Ok((ContentType::JSON, Json(\n        OrginfoStruct {\n            org_id: orgid,\n            owner_id: org.owner,\n            ca_crt: org.ca_crt,\n            authorized_users,\n        }\n    )))\n}\n\n#[post(\"/v1/org\")]\npub async fn create_org(user: TOTPAuthenticatedUserInfo, db: \u0026State\u003cPgPool\u003e, config: \u0026State\u003cTFConfig\u003e) -\u003e Result\u003c(ContentType, Json\u003cOrginfoStruct\u003e), (Status, String)\u003e {\n    if get_org_by_owner_id(user.user_id, db.inner()).await.map_err(|e| (Status::InternalServerError, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{} - {}\\\"}}]}}\", \"ERR_QL_QUERY_FAILED\", \"an error occurred while running the graphql query\", e)))?.is_some() {\n        return Err((Status::Conflict, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{}\\\"}}]}}\", \"ERR_USER_OWNS_ORG\", \"a user can only own one organization at a time\")))\n    }\n\n    // we need to generate a keypair and CA certificate for this new org\n\n    Ok((ContentType::JSON, Json(\n        OrginfoStruct {\n            org_id: orgid,\n            owner_id: org.owner,\n            ca_crt: org.ca_crt,\n            authorized_users,\n        }\n    )))\n}","traces":[],"covered":0,"coverable":0},{"path":["/","home","core","prj","e3t","trifid","trifid-api","src","routes","v1","signup.rs"],"content":"use rocket::{post, State};\nuse rocket::serde::json::Json;\nuse serde::{Serialize, Deserialize};\nuse std::time::{SystemTime, UNIX_EPOCH};\nuse rocket::http::{ContentType, Status};\nuse sqlx::PgPool;\nuse crate::config::TFConfig;\nuse crate::tokens::send_magic_link;\nuse rocket::options;\n\n#[derive(Serialize, Deserialize)]\n#[serde(crate = \"rocket::serde\")]\npub struct SignupRequest {\n    pub email: String,\n}\n\n#[derive(Serialize, Deserialize)]\n#[serde(crate = \"rocket::serde\")]\npub struct SignupResponseMetadata {}\n\n#[derive(Serialize, Deserialize)]\n#[serde(crate = \"rocket::serde\")]\npub struct SignupResponse {\n    pub data: Option\u003cString\u003e,\n    pub metadata: SignupResponseMetadata,\n}\n/*\ncreated_on TIMESTAMP NOT NULL,\n\n    banned INTEGER NOT NULL,\n    ban_reason VARCHAR(1024) NOT NULL\n */\n#[options(\"/v1/signup\")]\npub async fn options() -\u003e \u0026'static str {\n    \"\"\n}\n\n#[post(\"/v1/signup\", data = \"\u003creq\u003e\")]\npub async fn signup_request(req: Json\u003cSignupRequest\u003e, pool: \u0026State\u003cPgPool\u003e, config: \u0026State\u003cTFConfig\u003e) -\u003e Result\u003c(ContentType, Json\u003cSignupResponse\u003e), (Status, String)\u003e {\n    // figure out if the user already exists\n    let mut id = -1;\n    match sqlx::query!(\"SELECT id FROM users WHERE email = $1\", req.email.clone()).fetch_optional(pool.inner()).await {\n        Ok(res) =\u003e if let Some(r) = res { id = r.id as i64 },\n        Err(e) =\u003e {\n            return Err((Status::InternalServerError, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{} - {}\\\"}}]}}\", \"ERR_QL_QUERY_FAILED\", \"an error occurred while running the graphql query\", e)))\n        }\n    }\n\n    if id == -1 {\n        let id_res = match sqlx::query!(\"INSERT INTO users (email, created_on, banned, ban_reason, totp_secret, totp_otpurl, totp_verified) VALUES ($1, $2, $3, $4, $5, $6, $7) ON CONFLICT DO NOTHING RETURNING id;\", req.email, SystemTime::now().duration_since(UNIX_EPOCH).unwrap().as_secs() as i64, 0, \"\", \"\", \"\", 0).fetch_one(pool.inner()).await {\n            Ok(row) =\u003e row.id,\n            Err(e) =\u003e {\n                return Err((Status::InternalServerError, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{} - {}\\\"}}]}}\", \"ERR_QL_QUERY_FAILED\", \"an error occurred while running the graphql query\", e)))\n            }\n        };\n        id = id_res as i64;\n    }\n\n    // send magic link to email\n    match send_magic_link(id, req.email.clone(), pool.inner(), config.inner()).await {\n        Ok(_) =\u003e (),\n        Err(e) =\u003e {\n            return Err((Status::InternalServerError, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{} - {}\\\"}}]}}\", \"ERR_QL_QUERY_FAILED\", \"an error occurred while running the graphql query\", e)))\n        }\n    };\n\n    // this endpoint doesn't actually ever return an error? it will send you the magic link no matter what\n    // this appears to do the exact same thing as /v1/auth/magic-link, but it doesn't check if you have an account (magic-link does)\n    Ok((ContentType::JSON, Json(SignupResponse {\n        data: None,\n        metadata: SignupResponseMetadata {},\n    })))\n}","traces":[],"covered":0,"coverable":0},{"path":["/","home","core","prj","e3t","trifid","trifid-api","src","routes","v1","totp_authenticators.rs"],"content":"use rocket::http::{ContentType, Status};\nuse rocket::serde::json::Json;\nuse rocket::{State, post};\nuse sqlx::PgPool;\nuse serde::{Serialize, Deserialize};\nuse crate::auth::PartialUserInfo;\nuse crate::config::TFConfig;\nuse crate::tokens::{create_totp_token, user_has_totp};\nuse rocket::options;\n\n#[derive(Deserialize)]\npub struct TotpAuthenticatorsRequest {}\n#[derive(Serialize, Deserialize)]\n#[serde(crate = \"rocket::serde\")]\npub struct TotpAuthenticatorsResponseMetadata {}\n#[derive(Serialize, Deserialize)]\n#[serde(crate = \"rocket::serde\")]\npub struct TotpAuthenticatorsResponseData {\n    #[serde(rename = \"totpToken\")]\n    pub totp_token: String,\n    pub secret: String,\n    pub url: String,\n}\n#[derive(Serialize, Deserialize)]\n#[serde(crate = \"rocket::serde\")]\npub struct TotpAuthenticatorsResponse {\n    pub data: TotpAuthenticatorsResponseData,\n    pub metadata: TotpAuthenticatorsResponseMetadata,\n}\n\n#[options(\"/v1/totp-authenticators\")]\npub async fn options() -\u003e \u0026'static str {\n    \"\"\n}\n\n\n#[post(\"/v1/totp-authenticators\", data = \"\u003c_req\u003e\")]\npub async fn totp_authenticators_request(_req: Json\u003cTotpAuthenticatorsRequest\u003e, user: PartialUserInfo, db: \u0026State\u003cPgPool\u003e, config: \u0026State\u003cTFConfig\u003e) -\u003e Result\u003c(ContentType, Json\u003cTotpAuthenticatorsResponse\u003e), (Status, String)\u003e {\n    if match user_has_totp(user.user_id, db.inner()).await {\n        Ok(b) =\u003e b,\n        Err(e) =\u003e return Err((Status::InternalServerError, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{} - {}\\\"}}]}}\", \"ERR_UNABLE_TO_ISSUE\", \"an error occured trying to issue a session token, please try again later\", e)))\n    } {\n        return Err((Status::BadRequest, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{}\\\"}}]}}\", \"ERR_TOTP_ALREADY_EXISTS\", \"this user already has a totp authenticator on their account\")))\n    }\n\n    // generate a totp token\n    let (totptoken, totpmachine) = match create_totp_token(user.email, db.inner(), config.inner()).await {\n        Ok(t) =\u003e t,\n        Err(e) =\u003e return Err((Status::InternalServerError, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{} - {}\\\"}}]}}\", \"ERR_UNABLE_TO_ISSUE\", \"an error occured issuing a totp token, try again later\", e)))\n    };\n\n    Ok((ContentType::JSON, Json(TotpAuthenticatorsResponse {\n        data: TotpAuthenticatorsResponseData {\n            totp_token: totptoken,\n            secret: totpmachine.get_secret_base32(),\n            url: totpmachine.get_url(),\n        },\n        metadata: TotpAuthenticatorsResponseMetadata {},\n    })))\n}","traces":[],"covered":0,"coverable":0},{"path":["/","home","core","prj","e3t","trifid","trifid-api","src","routes","v1","verify_totp_authenticator.rs"],"content":"/*\n{\"totpToken\":\"totp-mH9eLzA9Q5WB-sg3Fq8CfkP13eTh3DxF25kVK2VEDOk\",\"code\":\"266242\"}\n{\"errors\":[{\"code\":\"ERR_INVALID_TOTP_TOKEN\",\"message\":\"TOTP token does not exist (maybe it expired?)\",\"path\":\"totpToken\"}]}\n\n\n{\"totpToken\":\"totp-gaUDaxPrrIBc8GEQ6z0vPisT8k0MEP1fgI8FA2ztLMw\",\"code\":\"175543\"}\n{\"data\":{\"authToken\":\"auth-O7mugxdYta-RKtLMqDW4j8XCJ85EfZKKezeZZXBYtFQ\"},\"metadata\":{}}\n*/\n\nuse rocket::http::{ContentType, Status};\nuse crate::auth::PartialUserInfo;\nuse rocket::post;\nuse rocket::serde::json::Json;\nuse rocket::State;\nuse serde::{Serialize, Deserialize};\nuse sqlx::PgPool;\nuse crate::tokens::{generate_auth_token, use_totp_token, verify_totp_token};\nuse rocket::options;\n\n#[derive(Serialize, Deserialize)]\npub struct VerifyTotpAuthenticatorRequest {\n    #[serde(rename = \"totpToken\")]\n    pub totp_token: String,\n    pub code: String,\n}\n\n#[derive(Serialize, Deserialize)]\npub struct VerifyTotpAuthenticatorResponseMetadata {}\n\n#[derive(Serialize, Deserialize)]\npub struct VerifyTotpAuthenticatorResponseData {\n    #[serde(rename = \"authToken\")]\n    pub auth_token: String,\n}\n\n#[derive(Serialize, Deserialize)]\npub struct VerifyTotpAuthenticatorResponse {\n    pub data: VerifyTotpAuthenticatorResponseData,\n    pub metadata: VerifyTotpAuthenticatorResponseMetadata,\n}\n\n#[options(\"/v1/verify-totp-authenticator\")]\npub async fn options() -\u003e \u0026'static str {\n    \"\"\n}\n\n\n#[post(\"/v1/verify-totp-authenticator\", data = \"\u003creq\u003e\")]\npub async fn verify_totp_authenticator_request(req: Json\u003cVerifyTotpAuthenticatorRequest\u003e, db: \u0026State\u003cPgPool\u003e, user: PartialUserInfo) -\u003e Result\u003c(ContentType, Json\u003cVerifyTotpAuthenticatorResponse\u003e), (Status, String)\u003e {\n    let totpmachine = match verify_totp_token(req.0.totp_token.clone(), user.email.clone(), db.inner()).await {\n        Ok(t) =\u003e t,\n        Err(e) =\u003e return Err((Status::Unauthorized, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{} - {}\\\"}}]}}\", \"ERR_UNAUTHORIZED\", \"this token is invalid\", e)))\n    };\n    if !totpmachine.check_current(\u0026req.0.code).unwrap() {\n        return Err((Status::Unauthorized, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{}\\\",\\\"path\\\":\\\"totpToken\\\"}}]}}\", \"ERR_INVALID_TOTP_CODE\", \"Invalid TOTP code\")))\n    }\n    match use_totp_token(req.0.totp_token, user.email, db.inner()).await {\n        Ok(_) =\u003e (),\n        Err(e) =\u003e return Err((Status::InternalServerError, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{} - {}\\\"}}]}}\", \"ERR_UNABLE_TO_ISSUE\", \"an error occured trying to issue a session token, please try again later\", e)))\n    }\n    Ok((ContentType::JSON, Json(VerifyTotpAuthenticatorResponse {\n        data: VerifyTotpAuthenticatorResponseData { auth_token: match generate_auth_token(user.user_id as i64, user.session_id, db.inner()).await {\n            Ok(at) =\u003e at,\n            Err(e) =\u003e return Err((Status::InternalServerError, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{} - {}\\\"}}]}}\", \"ERR_UNABLE_TO_ISSUE\", \"an error occured trying to issue a session token, please try again later\", e)))\n        } },\n        metadata: VerifyTotpAuthenticatorResponseMetadata {},\n    })))\n}","traces":[],"covered":0,"coverable":0},{"path":["/","home","core","prj","e3t","trifid","trifid-api","src","routes","v2","mod.rs"],"content":"pub mod whoami;","traces":[],"covered":0,"coverable":0},{"path":["/","home","core","prj","e3t","trifid","trifid-api","src","routes","v2","whoami.rs"],"content":"use chrono::{NaiveDateTime, Utc};\nuse serde::{Serialize, Deserialize};\nuse rocket::{options, get, State};\nuse rocket::http::{ContentType, Status};\nuse rocket::serde::json::Json;\nuse sqlx::PgPool;\nuse crate::auth::PartialUserInfo;\nuse crate::tokens::user_has_totp;\n\n#[derive(Serialize, Deserialize)]\npub struct WhoamiMetadata {}\n\n#[derive(Serialize, Deserialize)]\npub struct WhoamiActor {\n    pub id: String,\n    #[serde(rename = \"organizationID\")]\n    pub organization_id: String,\n    pub email: String,\n    #[serde(rename = \"createdAt\")]\n    pub created_at: String,\n    #[serde(rename = \"hasTOTPAuthenticator\")]\n    pub has_totpauthenticator: bool,\n}\n\n#[derive(Serialize, Deserialize)]\npub struct WhoamiData {\n    #[serde(rename = \"actorType\")]\n    pub actor_type: String,\n    pub actor: WhoamiActor,\n}\n\n#[derive(Serialize, Deserialize)]\npub struct WhoamiResponse {\n    pub data: WhoamiData,\n    pub metadata: WhoamiMetadata,\n}\n\n#[options(\"/v2/whoami\")]\npub fn options() -\u003e \u0026'static str {\n    \"\"\n}\n\n#[get(\"/v2/whoami\")]\npub async fn whoami_request(user: PartialUserInfo, db: \u0026State\u003cPgPool\u003e) -\u003e Result\u003c(ContentType, Json\u003cWhoamiResponse\u003e), (Status, String)\u003e {\n    Ok((ContentType::JSON, Json(WhoamiResponse {\n        data: WhoamiData {\n            actor_type: \"user\".to_string(),\n            actor: WhoamiActor {\n                id: user.user_id.to_string(),\n                organization_id: \"TEMP_ORG_BECAUSE_THAT_ISNT_IMPLEMENTED_YET\".to_string(),\n                email: user.email,\n                created_at: NaiveDateTime::from_timestamp_opt(user.created_at, 0).unwrap().and_local_timezone(Utc).unwrap().to_rfc3339(),\n                has_totpauthenticator: match user_has_totp(user.user_id, db.inner()).await {\n                    Ok(b) =\u003e b,\n                    Err(e) =\u003e return Err((Status::InternalServerError, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{} - {}\\\"}}]}}\", \"ERR_DBERROR\", \"an error occured trying to verify your user\", e)))\n                },\n            }\n        },\n        metadata: WhoamiMetadata {},\n    })))\n}","traces":[],"covered":0,"coverable":0},{"path":["/","home","core","prj","e3t","trifid","trifid-api","src","tokens.rs"],"content":"use std::error::Error;\nuse log::info;\nuse sqlx::PgPool;\nuse uuid::Uuid;\nuse crate::config::TFConfig;\nuse std::time::SystemTime;\nuse std::time::UNIX_EPOCH;\nuse totp_rs::{Secret, TOTP};\nuse crate::util::{TOTP_ALGORITHM, TOTP_DIGITS, TOTP_ISSUER, TOTP_SKEW, TOTP_STEP};\n\n// https://admin.defined.net/auth/magic-link?email=coredoescode%40gmail.com\u0026token=ml-ckBsgw_5IdK5VYgseBYcoV_v_cQjtdq1re_RhDu_MKg\npub async fn send_magic_link(id: i64, email: String, db: \u0026PgPool, config: \u0026TFConfig) -\u003e Result\u003c(), Box\u003cdyn Error\u003e\u003e {\n    let otp = format!(\"ml-{}\", Uuid::new_v4());\n    let otp_url = config.web_root.join(\u0026format!(\"/auth/magic-link?email={}\u0026token={}\", urlencoding::encode(\u0026email.clone()), otp.clone())).unwrap();\n    sqlx::query!(\"INSERT INTO magic_links (id, user_id, expires_on) VALUES ($1, $2, $3) ON CONFLICT DO NOTHING;\", otp, id as i32, SystemTime::now().duration_since(UNIX_EPOCH).unwrap().as_secs() as i32 + config.magic_links_valid_for as i32).execute(db).await?;\n    // TODO: send email\n    info!(\"sent magic link {} to {}, valid for {} seconds\", otp_url, email.clone(), config.magic_links_valid_for);\n    Ok(())\n}\n\npub async fn generate_session_token(user_id: i64, db: \u0026PgPool, config: \u0026TFConfig) -\u003e Result\u003cString, Box\u003cdyn Error\u003e\u003e {\n    let token = format!(\"st-{}\", Uuid::new_v4());\n    sqlx::query!(\"INSERT INTO session_tokens (id, user_id, expires_on) VALUES ($1, $2, $3) ON CONFLICT DO NOTHING;\", token, user_id as i32, SystemTime::now().duration_since(UNIX_EPOCH).unwrap().as_secs() as i32 + config.session_tokens_valid_for as i32).execute(db).await?;\n    Ok(token)\n}\npub async fn validate_session_token(token: String, db: \u0026PgPool) -\u003e Result\u003ci64, Box\u003cdyn Error\u003e\u003e {\n    Ok(sqlx::query!(\"SELECT user_id FROM session_tokens WHERE id = $1 AND expires_on \u003e $2\", token, SystemTime::now().duration_since(UNIX_EPOCH).unwrap().as_secs() as i32).fetch_one(db).await?.user_id as i64)\n}\n\npub async fn generate_auth_token(user_id: i64, session_id: String, db: \u0026PgPool) -\u003e Result\u003cString, Box\u003cdyn Error\u003e\u003e {\n    let token = format!(\"at-{}\", Uuid::new_v4());\n    sqlx::query!(\"INSERT INTO auth_tokens (id, session_token, user_id) VALUES ($1, $2, $3) ON CONFLICT DO NOTHING;\", token, session_id, user_id as i32).execute(db).await?;\n    Ok(token)\n}\npub async fn validate_auth_token(token: String, session_id: String, db: \u0026PgPool) -\u003e Result\u003c(), Box\u003cdyn Error\u003e\u003e {\n    validate_session_token(session_id.clone(), db).await?;\n    sqlx::query!(\"SELECT * FROM auth_tokens WHERE id = $1 AND session_token = $2\", token, session_id).fetch_one(db).await?;\n    Ok(())\n}\n\n\n/*\nCREATE TABLE totp_create_tokens (\n    id VARCHAR(39) NOT NULL PRIMARY KEY,\n    expires_on INTEGER NOT NULL,\n    totp_otpurl VARCHAR(3000) NOT NULL,\n    totp_secret VARCHAR(128) NOT NULL\n);\n */\n\npub async fn create_totp_token(email: String, db: \u0026PgPool, config: \u0026TFConfig) -\u003e Result\u003c(String, TOTP), Box\u003cdyn Error\u003e\u003e {\n    // create the TOTP parameters\n\n    let secret = Secret::generate_secret();\n    let totpmachine = TOTP::new(TOTP_ALGORITHM, TOTP_DIGITS, TOTP_SKEW, TOTP_STEP, secret.to_bytes().unwrap(), Some(TOTP_ISSUER.to_string()), email).unwrap();\n    let otpurl = totpmachine.get_url();\n    let otpsecret = totpmachine.get_secret_base32();\n\n    let otpid = format!(\"totp-{}\", Uuid::new_v4());\n\n    sqlx::query!(\"INSERT INTO totp_create_tokens (id, expires_on, totp_otpurl, totp_secret) VALUES ($1, $2, $3, $4);\", otpid.clone(), (SystemTime::now().duration_since(UNIX_EPOCH).unwrap().as_secs() as i64 + config.totp_verification_valid_for) as i32, otpurl, otpsecret).execute(db).await?;\n\n    Ok((otpid, totpmachine))\n}\n\npub async fn verify_totp_token(otpid: String, email: String, db: \u0026PgPool) -\u003e Result\u003cTOTP, Box\u003cdyn Error\u003e\u003e {\n    let totprow = sqlx::query!(\"SELECT * FROM totp_create_tokens WHERE id = $1 AND expires_on \u003e $2\", otpid, SystemTime::now().duration_since(UNIX_EPOCH).unwrap().as_secs() as i32).fetch_one(db).await?;\n    let secret = Secret::Encoded(totprow.totp_secret);\n    let totpmachine = TOTP::new(TOTP_ALGORITHM, TOTP_DIGITS, TOTP_SKEW, TOTP_STEP, secret.to_bytes().unwrap(), Some(TOTP_ISSUER.to_string()), email).unwrap();\n\n    if totpmachine.get_url() != totprow.totp_otpurl {\n        return Err(\"OTPURLs do not match (email does not match?)\".into())\n    }\n\n    Ok(totpmachine)\n}\n\npub async fn use_totp_token(otpid: String, email: String, db: \u0026PgPool) -\u003e Result\u003cTOTP, Box\u003cdyn Error\u003e\u003e {\n    let totpmachine = verify_totp_token(otpid.clone(), email.clone(), db).await?;\n    sqlx::query!(\"DELETE FROM totp_create_tokens WHERE id = $1\", otpid).execute(db).await?;\n    sqlx::query!(\"UPDATE users SET totp_otpurl = $1, totp_secret = $2, totp_verified = 1 WHERE email = $3\", totpmachine.get_url(), totpmachine.get_secret_base32(), email).execute(db).await?;\n    Ok(totpmachine)\n}\n\npub async fn get_totpmachine(user: i32, db: \u0026PgPool) -\u003e Result\u003cTOTP, Box\u003cdyn Error\u003e\u003e {\n    let user = sqlx::query!(\"SELECT totp_secret, totp_otpurl, email FROM users WHERE id = $1\", user).fetch_one(db).await?;\n    let secret = Secret::Encoded(user.totp_secret);\n    Ok(TOTP::new(TOTP_ALGORITHM, TOTP_DIGITS, TOTP_SKEW, TOTP_STEP, secret.to_bytes().unwrap(), Some(TOTP_ISSUER.to_string()), user.email).unwrap())\n}\n\npub async fn user_has_totp(user: i32, db: \u0026PgPool) -\u003e Result\u003cbool, Box\u003cdyn Error\u003e\u003e {\n    Ok(sqlx::query!(\"SELECT totp_verified FROM users WHERE id = $1\", user).fetch_one(db).await?.totp_verified == 1)\n}","traces":[],"covered":0,"coverable":0},{"path":["/","home","core","prj","e3t","trifid","trifid-api","src","util.rs"],"content":"use base64::Engine;\nuse totp_rs::Algorithm;\n\npub const TOTP_ALGORITHM: Algorithm = Algorithm::SHA1;\npub const TOTP_DIGITS: usize = 6;\npub const TOTP_SKEW: u8 = 1;\npub const TOTP_STEP: u64 = 30;\npub const TOTP_ISSUER: \u0026str = \"trifidapi\";\n\npub fn base64decode(val: \u0026str) -\u003e Result\u003cVec\u003cu8\u003e, base64::DecodeError\u003e {\n    base64::engine::general_purpose::STANDARD.decode(val)\n}\npub fn base64encode(val: Vec\u003cu8\u003e) -\u003e String {\n    base64::engine::general_purpose::STANDARD.encode(val)\n}","traces":[],"covered":0,"coverable":0},{"path":["/","home","core","prj","e3t","trifid","trifid-pki","src","ca.rs"],"content":"//! Structs to represent a pool of CA's and blacklisted certificates\n\nuse std::collections::HashMap;\nuse std::error::Error;\nuse std::fmt::{Display, Formatter};\nuse std::time::SystemTime;\nuse ed25519_dalek::VerifyingKey;\nuse crate::cert::{deserialize_nebula_certificate_from_pem, NebulaCertificate};\n\n/// A pool of trusted CA certificates, and certificates that should be blocked.\n/// This is equivalent to the `pki` section in a typical Nebula config.yml.\n#[derive(Default)]\npub struct NebulaCAPool {\n    /// The list of CA root certificates that should be trusted.\n    pub cas: HashMap\u003cString, NebulaCertificate\u003e,\n    /// The list of blocklisted certificate fingerprints\n    pub cert_blocklist: Vec\u003cString\u003e,\n    /// True if any of the member CAs certificates are expired. Must be handled.\n    pub expired: bool\n}\n\nimpl NebulaCAPool {\n    /// Create a new, blank CA pool\n    pub fn new() -\u003e Self {\n        Self::default()\n    }\n\n    /// Create a new CA pool from a set of PEM encoded CA certificates.\n    /// If any of the certificates are expired, the pool will **still be returned**, with the expired flag set.\n    /// This must be handled properly.\n    /// # Errors\n    /// This function will return an error if PEM data provided was invalid.\n    pub fn new_from_pem(bytes: \u0026[u8]) -\u003e Result\u003cSelf, Box\u003cdyn Error\u003e\u003e {\n        let pems = pem::parse_many(bytes)?;\n\n        let mut pool = Self::new();\n\n        for cert in pems {\n            match pool.add_ca_certificate(pem::encode(\u0026cert).as_bytes()) {\n                Ok(did_expire) =\u003e if did_expire { pool.expired = true },\n                Err(e) =\u003e return Err(e)\n            }\n        }\n\n        Ok(pool)\n    }\n\n    /// Add a given CA certificate to the CA pool. If the certificate is expired, it will **still be added** - the return value will be `true` instead of `false`\n    /// # Errors\n    /// This function will return an error if the certificate is invalid in any way.\n    pub fn add_ca_certificate(\u0026mut self, bytes: \u0026[u8]) -\u003e Result\u003cbool, Box\u003cdyn Error\u003e\u003e {\n        let cert = deserialize_nebula_certificate_from_pem(bytes)?;\n\n        if !cert.details.is_ca {\n            return Err(CaPoolError::NotACA.into())\n        }\n\n        if !cert.check_signature(\u0026VerifyingKey::from_bytes(\u0026cert.details.public_key)?)? {\n            return Err(CaPoolError::NotSelfSigned.into())\n        }\n\n        let fingerprint = cert.sha256sum()?;\n        let expired = cert.expired(SystemTime::now());\n\n        self.cas.insert(fingerprint, cert);\n\n       Ok(expired)\n    }\n\n    /// Blocklist the given certificate in the CA pool\n    pub fn blocklist_fingerprint(\u0026mut self, fingerprint: \u0026str) {\n        self.cert_blocklist.push(fingerprint.to_string());\n    }\n\n    /// Clears the list of blocklisted fingerprints\n    pub fn reset_blocklist(\u0026mut self) {\n        self.cert_blocklist = vec![];\n    }\n\n    /// Checks if the given certificate is blocklisted\n    pub fn is_blocklisted(\u0026self, cert: \u0026NebulaCertificate) -\u003e bool {\n        let Ok(h) = cert.sha256sum() else { return false };\n        self.cert_blocklist.contains(\u0026h)\n    }\n\n    /// Gets the CA certificate used to sign the given certificate\n    /// # Errors\n    /// This function will return an error if the certificate does not have an issuer attached (it is self-signed)\n    pub fn get_ca_for_cert(\u0026self, cert: \u0026NebulaCertificate) -\u003e Result\u003cOption\u003c\u0026NebulaCertificate\u003e, Box\u003cdyn Error\u003e\u003e {\n        if cert.details.issuer == String::new() {\n            return Err(CaPoolError::NoIssuer.into())\n        }\n\n        Ok(self.cas.get(\u0026cert.details.issuer))\n    }\n\n    /// Get a list of trusted CA fingerprints\n    pub fn get_fingerprints(\u0026self) -\u003e Vec\u003c\u0026String\u003e {\n        self.cas.keys().collect()\n    }\n}\n\n#[derive(Debug)]\n/// A list of errors that can happen when working with a CA Pool\npub enum CaPoolError {\n    /// Tried to add a non-CA cert to the CA pool\n    NotACA,\n    /// Tried to add a non-self-signed cert to the CA pool (all CAs must be root certificates)\n    NotSelfSigned,\n    /// Tried to look up a certificate that does not have an issuer field\n    NoIssuer\n}\nimpl Error for CaPoolError {}\nimpl Display for CaPoolError {\n    fn fmt(\u0026self, f: \u0026mut Formatter\u003c'_\u003e) -\u003e std::fmt::Result {\n        match self {\n            Self::NotACA =\u003e write!(f, \"Tried to add a non-CA cert to the CA pool\"),\n            Self::NotSelfSigned =\u003e write!(f, \"Tried to add a non-self-signed cert to the CA pool (all CAs must be root certificates)\"),\n            Self::NoIssuer =\u003e write!(f, \"Tried to look up a certificate with a null issuer field\")\n        }\n    }\n}","traces":[{"line":24,"address":[420720],"length":1,"stats":{"Line":0},"fn_name":"new"},{"line":25,"address":[420728],"length":1,"stats":{"Line":0},"fn_name":null},{"line":33,"address":[421562,421876,420752],"length":1,"stats":{"Line":0},"fn_name":"new_from_pem"},{"line":34,"address":[420919,420785],"length":1,"stats":{"Line":0},"fn_name":null},{"line":36,"address":[420909],"length":1,"stats":{"Line":0},"fn_name":null},{"line":38,"address":[421691,421812,421047,421141],"length":1,"stats":{"Line":0},"fn_name":null},{"line":39,"address":[421363,421442,421524],"length":1,"stats":{"Line":0},"fn_name":null},{"line":40,"address":[421783,421573],"length":1,"stats":{"Line":0},"fn_name":null},{"line":41,"address":[421610],"length":1,"stats":{"Line":0},"fn_name":null},{"line":45,"address":[421817],"length":1,"stats":{"Line":0},"fn_name":null},{"line":51,"address":[421904,423308],"length":1,"stats":{"Line":0},"fn_name":"add_ca_certificate"},{"line":52,"address":[421976,422134],"length":1,"stats":{"Line":0},"fn_name":null},{"line":54,"address":[422114],"length":1,"stats":{"Line":0},"fn_name":null},{"line":55,"address":[422303,422214],"length":1,"stats":{"Line":0},"fn_name":null},{"line":58,"address":[422570,422328,422207],"length":1,"stats":{"Line":0},"fn_name":null},{"line":59,"address":[422739],"length":1,"stats":{"Line":0},"fn_name":null},{"line":62,"address":[422933,422732,422815],"length":1,"stats":{"Line":0},"fn_name":null},{"line":63,"address":[423090,422905],"length":1,"stats":{"Line":0},"fn_name":null},{"line":65,"address":[423114],"length":1,"stats":{"Line":0},"fn_name":null},{"line":67,"address":[423252],"length":1,"stats":{"Line":0},"fn_name":null},{"line":71,"address":[423360],"length":1,"stats":{"Line":0},"fn_name":"blocklist_fingerprint"},{"line":72,"address":[423379],"length":1,"stats":{"Line":0},"fn_name":null},{"line":76,"address":[423424,423488],"length":1,"stats":{"Line":0},"fn_name":"reset_blocklist"},{"line":77,"address":[423442,423520],"length":1,"stats":{"Line":0},"fn_name":null},{"line":81,"address":[423840,423552,423812],"length":1,"stats":{"Line":0},"fn_name":"is_blocklisted"},{"line":82,"address":[423751,423574,423694],"length":1,"stats":{"Line":0},"fn_name":null},{"line":83,"address":[423773,423721],"length":1,"stats":{"Line":0},"fn_name":null},{"line":89,"address":[423990,423856],"length":1,"stats":{"Line":0},"fn_name":"get_ca_for_cert"},{"line":90,"address":[423889],"length":1,"stats":{"Line":0},"fn_name":null},{"line":91,"address":[424055],"length":1,"stats":{"Line":0},"fn_name":null},{"line":94,"address":[424022],"length":1,"stats":{"Line":0},"fn_name":null},{"line":98,"address":[424096],"length":1,"stats":{"Line":0},"fn_name":"get_fingerprints"},{"line":99,"address":[424115],"length":1,"stats":{"Line":0},"fn_name":null},{"line":115,"address":[424160],"length":1,"stats":{"Line":0},"fn_name":"fmt"},{"line":116,"address":[424187],"length":1,"stats":{"Line":0},"fn_name":null},{"line":117,"address":[424219],"length":1,"stats":{"Line":0},"fn_name":null},{"line":118,"address":[424276],"length":1,"stats":{"Line":0},"fn_name":null},{"line":119,"address":[424333],"length":1,"stats":{"Line":0},"fn_name":null}],"covered":0,"coverable":38},{"path":["/","home","core","prj","e3t","trifid","trifid-pki","src","cert.rs"],"content":"//! Manage Nebula PKI Certificates\n//! This is pretty much a direct port of nebula/cert/cert.go\n\nuse std::error::Error;\nuse std::fmt::{Display, Formatter};\nuse std::net::Ipv4Addr;\nuse std::ops::Add;\nuse std::time::{Duration, SystemTime, UNIX_EPOCH};\nuse ed25519_dalek::{Signature, Signer, SigningKey, Verifier, VerifyingKey};\nuse ipnet::{Ipv4Net};\nuse pem::Pem;\nuse quick_protobuf::{BytesReader, MessageRead, MessageWrite, Writer};\nuse sha2::Sha256;\nuse crate::ca::NebulaCAPool;\nuse crate::cert_codec::{RawNebulaCertificate, RawNebulaCertificateDetails};\nuse sha2::Digest;\n\n/// The length, in bytes, of public keys\npub const PUBLIC_KEY_LENGTH: i32 = 32;\n\n/// The PEM banner for certificates\npub const CERT_BANNER: \u0026str = \"NEBULA CERTIFICATE\";\n/// The PEM banner for X25519 private keys\npub const X25519_PRIVATE_KEY_BANNER: \u0026str = \"NEBULA X25519 PRIVATE KEY\";\n/// The PEM banner for X25519 public keys\npub const X25519_PUBLIC_KEY_BANNER: \u0026str = \"NEBULA X25519 PUBLIC KEY\";\n/// The PEM banner for Ed25519 private keys\npub const ED25519_PRIVATE_KEY_BANNER: \u0026str = \"NEBULA ED25519 PRIVATE KEY\";\n/// The PEM banner for Ed25519 public keys\npub const ED25519_PUBLIC_KEY_BANNER: \u0026str = \"NEBULA ED25519 PUBLIC KEY\";\n\n/// A Nebula PKI certificate\n#[derive(Debug, Clone)]\npub struct NebulaCertificate {\n    /// The signed data of this certificate\n    pub details: NebulaCertificateDetails,\n    /// The Ed25519 signature of this certificate\n    pub signature: Vec\u003cu8\u003e\n}\n\n/// The signed details contained in a Nebula PKI certificate\n#[derive(Debug, Clone)]\npub struct NebulaCertificateDetails {\n    /// The name of the identity this certificate was issued for\n    pub name: String,\n    /// The IPv4 addresses issued to this node\n    pub ips: Vec\u003cIpv4Net\u003e,\n    /// The IPv4 subnets this node is responsible for routing\n    pub subnets: Vec\u003cIpv4Net\u003e,\n    /// The groups this node is a part of\n    pub groups: Vec\u003cString\u003e,\n    /// Certificate start date and time\n    pub not_before: SystemTime,\n    /// Certificate expiry date and time\n    pub not_after: SystemTime,\n    /// Public key\n    pub public_key: [u8; PUBLIC_KEY_LENGTH as usize],\n    /// Is this node a CA?\n    pub is_ca: bool,\n    /// SHA256 of issuer certificate. If blank, this cert is self-signed.\n    pub issuer: String\n}\n\n/// A list of errors that can occur parsing certificates\n#[derive(Debug)]\npub enum CertificateError {\n    /// Attempted to deserialize a certificate from an empty byte array\n    EmptyByteArray,\n    /// The encoded Details field is null\n    NilDetails,\n    /// The encoded Ips field is not formatted correctly\n    IpsNotPairs,\n    /// The encoded Subnets field is not formatted correctly\n    SubnetsNotPairs,\n    /// Signatures are expected to be 64 bytes but the signature on the certificate was a different length\n    WrongSigLength,\n    /// Public keys are expected to be 32 bytes but the public key on this cert is not\n    WrongKeyLength,\n    /// Certificates should have the PEM tag `NEBULA CERTIFICATE`, but this block did not\n    WrongPemTag,\n    /// This certificate either is not yet valid or has already expired\n    Expired,\n    /// The public key does not match the expected value\n    KeyMismatch\n}\nimpl Display for CertificateError {\n    fn fmt(\u0026self, f: \u0026mut Formatter\u003c'_\u003e) -\u003e std::fmt::Result {\n        match self {\n            Self::EmptyByteArray =\u003e write!(f, \"Certificate bytearray is empty\"),\n            Self::NilDetails =\u003e write!(f, \"The encoded Details field is null\"),\n            Self::IpsNotPairs =\u003e write!(f, \"encoded IPs should be in pairs, an odd number was found\"),\n            Self::SubnetsNotPairs =\u003e write!(f, \"encoded subnets should be in pairs, an odd number was found\"),\n            Self::WrongSigLength =\u003e write!(f, \"Signature should be 64 bytes but is a different size\"),\n            Self::WrongKeyLength =\u003e write!(f, \"Public keys are expected to be 32 bytes but the public key on this cert is not\"),\n            Self::WrongPemTag =\u003e write!(f, \"Certificates should have the PEM tag `NEBULA CERTIFICATE`, but this block did not\"),\n            Self::Expired =\u003e write!(f, \"This certificate either is not yet valid or has already expired\"),\n            Self::KeyMismatch =\u003e write!(f, \"Key does not match expected value\")\n        }\n    }\n}\nimpl Error for CertificateError {}\n\nfn map_cidr_pairs(pairs: \u0026[u32]) -\u003e Result\u003cVec\u003cIpv4Net\u003e, Box\u003cdyn Error\u003e\u003e {\n    let mut res_vec = vec![];\n    for pair in pairs.chunks(2) {\n        res_vec.push(Ipv4Net::with_netmask(Ipv4Addr::from(pair[0]), Ipv4Addr::from(pair[1]))?);\n    }\n    Ok(res_vec)\n}\n\nimpl Display for NebulaCertificate {\n    #[allow(clippy::unwrap_used)]\n    fn fmt(\u0026self, f: \u0026mut Formatter\u003c'_\u003e) -\u003e std::fmt::Result {\n        writeln!(f, \"NebulaCertificate {{\")?;\n        writeln!(f, \"   Details {{\")?;\n        writeln!(f, \"       Name: {}\", self.details.name)?;\n        writeln!(f, \"       Ips: {:?}\", self.details.ips)?;\n        writeln!(f, \"       Subnets: {:?}\", self.details.subnets)?;\n        writeln!(f, \"       Groups: {:?}\", self.details.groups)?;\n        writeln!(f, \"       Not before: {:?}\", self.details.not_before)?;\n        writeln!(f, \"       Not after: {:?}\", self.details.not_after)?;\n        writeln!(f, \"       Is CA: {}\", self.details.is_ca)?;\n        writeln!(f, \"       Issuer: {}\", self.details.issuer)?;\n        writeln!(f, \"       Public key: {}\", hex::encode(self.details.public_key))?;\n        writeln!(f, \"   }}\")?;\n        writeln!(f, \"   Fingerprint: {}\", self.sha256sum().unwrap())?;\n        writeln!(f, \"   Signature: {}\", hex::encode(self.signature.clone()))?;\n        writeln!(f, \"}}\")\n    }\n}\n\n/// Given a protobuf-encoded certificate bytearray, deserialize it into a `NebulaCertificate` object.\n/// # Errors\n/// This function will return an error if there is a protobuf parsing error, or if the certificate data is invalid.\n/// # Panics\npub fn deserialize_nebula_certificate(bytes: \u0026[u8]) -\u003e Result\u003cNebulaCertificate, Box\u003cdyn Error\u003e\u003e {\n    if bytes.is_empty() {\n        return Err(CertificateError::EmptyByteArray.into())\n    }\n\n    let mut reader = BytesReader::from_bytes(bytes);\n\n    let raw_cert = RawNebulaCertificate::from_reader(\u0026mut reader, bytes)?;\n\n    let details = raw_cert.Details.ok_or(CertificateError::NilDetails)?;\n\n    if details.Ips.len() % 2 != 0 {\n        return Err(CertificateError::IpsNotPairs.into())\n    }\n\n    if details.Subnets.len() % 2 != 0 {\n        return Err(CertificateError::SubnetsNotPairs.into())\n    }\n\n    let mut nebula_cert;\n    #[allow(clippy::cast_sign_loss)]\n    {\n        nebula_cert = NebulaCertificate {\n            details: NebulaCertificateDetails {\n                name: details.Name.to_string(),\n                ips: map_cidr_pairs(\u0026details.Ips)?,\n                subnets: map_cidr_pairs(\u0026details.Subnets)?,\n                groups: details.Groups.iter().map(std::string::ToString::to_string).collect(),\n                not_before: SystemTime::UNIX_EPOCH.add(Duration::from_secs(details.NotBefore as u64)),\n                not_after: SystemTime::UNIX_EPOCH.add(Duration::from_secs(details.NotAfter as u64)),\n                public_key: [0u8; 32],\n                is_ca: details.IsCA,\n                issuer: hex::encode(details.Issuer),\n            },\n            signature: vec![],\n        };\n    }\n\n    nebula_cert.signature = raw_cert.Signature;\n\n    if details.PublicKey.len() != 32 {\n        return Err(CertificateError::WrongKeyLength.into())\n    }\n\n    #[allow(clippy::unwrap_used)] { nebula_cert.details.public_key = details.PublicKey.try_into().unwrap(); }\n\n    Ok(nebula_cert)\n}\n\n/// A list of errors that can occur parsing keys\n#[derive(Debug)]\npub enum KeyError {\n    /// Keys should have their associated PEM tags but this had the wrong one\n    WrongPemTag\n}\nimpl Display for KeyError {\n    fn fmt(\u0026self, f: \u0026mut Formatter\u003c'_\u003e) -\u003e std::fmt::Result {\n        match self {\n            Self::WrongPemTag =\u003e write!(f, \"Keys should have their associated PEM tags but this had the wrong one\")\n        }\n    }\n}\nimpl Error for KeyError {}\n\n\n/// Deserialize the first PEM block in the given byte array into a `NebulaCertificate`\n/// # Errors\n/// This function will return an error if the PEM data is invalid, or if there is an error parsing the certificate (see `deserialize_nebula_certificate`)\npub fn deserialize_nebula_certificate_from_pem(bytes: \u0026[u8]) -\u003e Result\u003cNebulaCertificate, Box\u003cdyn Error\u003e\u003e {\n    let pem = pem::parse(bytes)?;\n    if pem.tag != CERT_BANNER {\n        return Err(CertificateError::WrongPemTag.into())\n    }\n    deserialize_nebula_certificate(\u0026pem.contents)\n}\n\n/// Simple helper to PEM encode an X25519 private key\npub fn serialize_x25519_private(bytes: \u0026[u8]) -\u003e Vec\u003cu8\u003e {\n    pem::encode(\u0026Pem {\n        tag: X25519_PRIVATE_KEY_BANNER.to_string(),\n        contents: bytes.to_vec(),\n    }).as_bytes().to_vec()\n}\n\n/// Simple helper to PEM encode an X25519 public key\npub fn serialize_x25519_public(bytes: \u0026[u8]) -\u003e Vec\u003cu8\u003e {\n    pem::encode(\u0026Pem {\n        tag: X25519_PUBLIC_KEY_BANNER.to_string(),\n        contents: bytes.to_vec(),\n    }).as_bytes().to_vec()\n}\n\n/// Attempt to deserialize a PEM encoded X25519 private key\n/// # Errors\n/// This function will return an error if the PEM data is invalid or has the wrong tag\npub fn deserialize_x25519_private(bytes: \u0026[u8]) -\u003e Result\u003cVec\u003cu8\u003e, Box\u003cdyn Error\u003e\u003e {\n    let pem = pem::parse(bytes)?;\n    if pem.tag != X25519_PRIVATE_KEY_BANNER {\n        return Err(KeyError::WrongPemTag.into())\n    }\n    Ok(pem.contents)\n}\n\n/// Attempt to deserialize a PEM encoded X25519 public key\n/// # Errors\n/// This function will return an error if the PEM data is invalid or has the wrong tag\npub fn deserialize_x25519_public(bytes: \u0026[u8]) -\u003e Result\u003cVec\u003cu8\u003e, Box\u003cdyn Error\u003e\u003e {\n    let pem = pem::parse(bytes)?;\n    if pem.tag != X25519_PUBLIC_KEY_BANNER {\n        return Err(KeyError::WrongPemTag.into())\n    }\n    Ok(pem.contents)\n}\n\n/// Simple helper to PEM encode an Ed25519 private key\npub fn serialize_ed25519_private(bytes: \u0026[u8]) -\u003e Vec\u003cu8\u003e {\n    pem::encode(\u0026Pem {\n        tag: ED25519_PRIVATE_KEY_BANNER.to_string(),\n        contents: bytes.to_vec(),\n    }).as_bytes().to_vec()\n}\n\n/// Simple helper to PEM encode an Ed25519 public key\npub fn serialize_ed25519_public(bytes: \u0026[u8]) -\u003e Vec\u003cu8\u003e {\n    pem::encode(\u0026Pem {\n        tag: ED25519_PUBLIC_KEY_BANNER.to_string(),\n        contents: bytes.to_vec(),\n    }).as_bytes().to_vec()\n}\n\n/// Attempt to deserialize a PEM encoded Ed25519 private key\n/// # Errors\n/// This function will return an error if the PEM data is invalid or has the wrong tag\npub fn deserialize_ed25519_private(bytes: \u0026[u8]) -\u003e Result\u003cVec\u003cu8\u003e, Box\u003cdyn Error\u003e\u003e {\n    let pem = pem::parse(bytes)?;\n    if pem.tag != ED25519_PRIVATE_KEY_BANNER {\n        return Err(KeyError::WrongPemTag.into())\n    }\n    Ok(pem.contents)\n}\n\n/// Attempt to deserialize a PEM encoded Ed25519 public key\n/// # Errors\n/// This function will return an error if the PEM data is invalid or has the wrong tag\npub fn deserialize_ed25519_public(bytes: \u0026[u8]) -\u003e Result\u003cVec\u003cu8\u003e, Box\u003cdyn Error\u003e\u003e {\n    let pem = pem::parse(bytes)?;\n    if pem.tag != ED25519_PUBLIC_KEY_BANNER {\n        return Err(KeyError::WrongPemTag.into())\n    }\n    Ok(pem.contents)\n}\n\nimpl NebulaCertificate {\n    /// Sign a nebula certificate with the provided private key\n    /// # Errors\n    /// This function will return an error if the certificate could not be serialized or signed.\n    pub fn sign(\u0026mut self, key: \u0026SigningKey) -\u003e Result\u003c(), Box\u003cdyn Error\u003e\u003e {\n        let mut out = Vec::new();\n        let mut writer = Writer::new(\u0026mut out);\n        self.get_raw_details().write_message(\u0026mut writer)?;\n\n        self.signature = key.sign(\u0026out).to_vec();\n        Ok(())\n    }\n\n    /// Verify the signature on a certificate with the provided public key\n    /// # Errors\n    /// This function will return an error if the certificate could not be serialized or the signature could not be checked.\n    pub fn check_signature(\u0026self, key: \u0026VerifyingKey) -\u003e Result\u003cbool, Box\u003cdyn Error\u003e\u003e {\n        let mut out = Vec::new();\n        let mut writer = Writer::new(\u0026mut out);\n        self.get_raw_details().write_message(\u0026mut writer)?;\n\n        let sig = Signature::from_slice(\u0026self.signature)?;\n\n        Ok(key.verify(\u0026out, \u0026sig).is_ok())\n    }\n\n    /// Returns true if the signature is too young or too old compared to the provided time\n    pub fn expired(\u0026self, time: SystemTime) -\u003e bool {\n        self.details.not_before \u003e time || self.details.not_after \u003c time\n    }\n\n    /// Verify will ensure a certificate is good in all respects (expiry, group membership, signature, cert blocklist, etc)\n    /// # Errors\n    /// This function will return an error if there is an error parsing the cert or the CA pool.\n    pub fn verify(\u0026self, time: SystemTime, ca_pool: \u0026NebulaCAPool) -\u003e Result\u003cCertificateValidity, Box\u003cdyn Error\u003e\u003e {\n        if ca_pool.is_blocklisted(self) {\n            return Ok(CertificateValidity::Blocklisted);\n        }\n\n        let Some(signer) = ca_pool.get_ca_for_cert(self)? else { return Ok(CertificateValidity::NotSignedByThisCAPool) };\n\n        if signer.expired(time) {\n            return Ok(CertificateValidity::RootCertExpired)\n        }\n\n        if self.expired(time) {\n            return Ok(CertificateValidity::CertExpired)\n        }\n\n        if !self.check_signature(\u0026VerifyingKey::from_bytes(\u0026signer.details.public_key)?)? {\n            return Ok(CertificateValidity::BadSignature)\n        }\n\n        Ok(self.check_root_constraints(signer))\n    }\n\n    /// Make sure that this certificate does not break any of the constraints set by the signing certificate\n    pub fn check_root_constraints(\u0026self, signer: \u0026Self) -\u003e CertificateValidity {\n        // Make sure this cert doesn't expire after the signer\n        println!(\"{:?} {:?}\", signer.details.not_before, self.details.not_before);\n        if signer.details.not_before \u003c self.details.not_before {\n            return CertificateValidity::CertExpiresAfterSigner;\n        }\n\n        // Make sure this cert doesn't come into validity before the root\n        if signer.details.not_before \u003e self.details.not_before {\n            return CertificateValidity::CertValidBeforeSigner;\n        }\n\n        // If the signer contains a limited set of groups, make sure this cert only has a subset of them\n        if !signer.details.groups.is_empty() {\n            println!(\"root groups: {:?}, child groups: {:?}\", signer.details.groups, self.details.groups);\n            for group in \u0026self.details.groups {\n                if !signer.details.groups.contains(group) {\n                    return CertificateValidity::GroupNotPresentOnSigner;\n                }\n            }\n        }\n\n        // If the signer contains a limited set of IP ranges, make sure the cert only contains a subset\n        if !signer.details.ips.is_empty() {\n            for ip in \u0026self.details.ips {\n                if !net_match(*ip, \u0026signer.details.ips) {\n                    return CertificateValidity::IPNotPresentOnSigner;\n                }\n            }\n        }\n\n        // If the signer contains a limited set of subnets, make sure the cert only contains a subset\n        if !signer.details.subnets.is_empty() {\n            for subnet in \u0026self.details.subnets {\n                if !net_match(*subnet, \u0026signer.details.subnets) {\n                    return CertificateValidity::SubnetNotPresentOnSigner;\n                }\n            }\n        }\n\n        CertificateValidity::Ok\n    }\n\n    #[allow(clippy::unwrap_used)]\n    /// Verify if the given private key corresponds to the public key contained in this certificate\n    /// # Errors\n    /// This function will return an error if either keys are invalid.\n    /// # Panics\n    /// This function, while containing calls to unwrap, has proper bounds checking and will not panic.\n    pub fn verify_private_key(\u0026self, key: \u0026[u8]) -\u003e Result\u003c(), Box\u003cdyn Error\u003e\u003e {\n        if self.details.is_ca {\n            // convert the keys\n            if key.len() != 64 {\n                return Err(\"key not 64-bytes long\".into())\n            }\n\n\n            let secret = SigningKey::from_keypair_bytes(key.try_into().unwrap())?;\n            let pub_key = secret.verifying_key().to_bytes();\n            if pub_key != self.details.public_key {\n                return Err(CertificateError::KeyMismatch.into());\n            }\n\n            return Ok(());\n        }\n\n        if key.len() != 32 {\n            return Err(\"key not 32-bytes long\".into())\n        }\n\n        let pubkey_raw = SigningKey::from_bytes(key.try_into()?).verifying_key();\n        let pubkey = pubkey_raw.as_bytes();\n\n        println!(\"{} {}\", hex::encode(pubkey), hex::encode(self.details.public_key));\n        if *pubkey != self.details.public_key {\n            return Err(CertificateError::KeyMismatch.into());\n        }\n\n        Ok(())\n    }\n\n\n    /// Get a protobuf-ready raw struct, ready for serialization\n    #[allow(clippy::expect_used)]\n    #[allow(clippy::cast_possible_wrap)]\n    /// # Panics\n    /// This function will panic if time went backwards, or if the certificate contains extremely invalid data.\n    pub fn get_raw_details(\u0026self) -\u003e RawNebulaCertificateDetails {\n\n        let mut raw = RawNebulaCertificateDetails {\n            Name: self.details.name.clone(),\n            Ips: vec![],\n            Subnets: vec![],\n            Groups: self.details.groups.iter().map(std::convert::Into::into).collect(),\n            NotBefore: self.details.not_before.duration_since(UNIX_EPOCH).expect(\"Time went backwards\").as_secs() as i64,\n            NotAfter: self.details.not_after.duration_since(UNIX_EPOCH).expect(\"Time went backwards\").as_secs() as i64,\n            PublicKey: self.details.public_key.into(),\n            IsCA: self.details.is_ca,\n            Issuer: hex::decode(\u0026self.details.issuer).expect(\"Issuer was not a hex-encoded value\"),\n        };\n\n        for ip_net in \u0026self.details.ips {\n            raw.Ips.push(ip_net.addr().into());\n            raw.Ips.push(ip_net.netmask().into());\n        }\n\n        for subnet in \u0026self.details.subnets {\n            raw.Subnets.push(subnet.addr().into());\n            raw.Subnets.push(subnet.netmask().into());\n        }\n\n        raw\n    }\n\n    /// Will serialize this cert into a protobuf byte array.\n    /// # Errors\n    /// This function will return an error if protobuf was unable to serialize the data.\n    pub fn serialize(\u0026self) -\u003e Result\u003cVec\u003cu8\u003e, Box\u003cdyn Error\u003e\u003e {\n        let raw_cert = RawNebulaCertificate {\n            Details: Some(self.get_raw_details()),\n            Signature: self.signature.clone(),\n        };\n\n        let mut out = vec![];\n        let mut writer = Writer::new(\u0026mut out);\n        raw_cert.write_message(\u0026mut writer)?;\n\n        Ok(out)\n    }\n\n    /// Will serialize this cert into a PEM byte array.\n    /// # Errors\n    /// This function will return an error if protobuf was unable to serialize the data.\n    pub fn serialize_to_pem(\u0026self) -\u003e Result\u003cVec\u003cu8\u003e, Box\u003cdyn Error\u003e\u003e {\n        let pbuf_bytes = self.serialize()?;\n\n        Ok(pem::encode(\u0026Pem {\n            tag: CERT_BANNER.to_string(),\n            contents: pbuf_bytes,\n        }).as_bytes().to_vec())\n    }\n\n    /// Get the fingerprint of this certificate\n    /// # Errors\n    /// This functiom will return an error if protobuf was unable to serialize the cert.\n    pub fn sha256sum(\u0026self) -\u003e Result\u003cString, Box\u003cdyn Error\u003e\u003e {\n        let pbuf_bytes = self.serialize()?;\n\n        let mut hasher = Sha256::new();\n        hasher.update(pbuf_bytes);\n\n        Ok(hex::encode(hasher.finalize()))\n    }\n}\n\n/// A list of possible errors that can happen validating a certificate\n#[derive(Eq, PartialEq, Debug)]\npub enum CertificateValidity {\n    /// There are no issues with this certificate\n    Ok,\n    /// This cert has been blocklisted in the given CA pool\n    Blocklisted,\n    /// The certificate that signed this cert is expired\n    RootCertExpired,\n    /// This cert is expired\n    CertExpired,\n    /// This cert's signature is invalid\n    BadSignature,\n    /// This cert was not signed by any CAs in the CA pool\n    NotSignedByThisCAPool,\n    /// This cert expires after the signer's cert expires\n    CertExpiresAfterSigner,\n    /// This cert enters validity before the signer's cert does\n    CertValidBeforeSigner,\n    /// A group present on this certificate is not present on the signer's certificate\n    GroupNotPresentOnSigner,\n    /// An IP present on this certificate is not present on the signer's certificate\n    IPNotPresentOnSigner,\n    /// A subnet on this certificate is not present on the signer's certificate\n    SubnetNotPresentOnSigner\n}\n\nfn net_match(cert_ip: Ipv4Net, root_ips: \u0026Vec\u003cIpv4Net\u003e) -\u003e bool {\n    for net in root_ips {\n        if net.contains(\u0026cert_ip) {\n            return true;\n        }\n    }\n    false\n}","traces":[{"line":88,"address":[505616],"length":1,"stats":{"Line":0},"fn_name":"fmt"},{"line":89,"address":[505643],"length":1,"stats":{"Line":0},"fn_name":null},{"line":90,"address":[505674],"length":1,"stats":{"Line":0},"fn_name":null},{"line":91,"address":[505734],"length":1,"stats":{"Line":0},"fn_name":null},{"line":92,"address":[505794],"length":1,"stats":{"Line":0},"fn_name":null},{"line":93,"address":[505854],"length":1,"stats":{"Line":0},"fn_name":null},{"line":94,"address":[505920],"length":1,"stats":{"Line":0},"fn_name":null},{"line":95,"address":[505986],"length":1,"stats":{"Line":0},"fn_name":null},{"line":96,"address":[506052],"length":1,"stats":{"Line":0},"fn_name":null},{"line":97,"address":[506115],"length":1,"stats":{"Line":0},"fn_name":null},{"line":98,"address":[506178],"length":1,"stats":{"Line":0},"fn_name":null},{"line":104,"address":[506256,507187],"length":1,"stats":{"Line":1},"fn_name":"map_cidr_pairs"},{"line":105,"address":[506299],"length":1,"stats":{"Line":1},"fn_name":null},{"line":106,"address":[506397,506621,506336],"length":1,"stats":{"Line":3},"fn_name":null},{"line":107,"address":[506663,507182],"length":1,"stats":{"Line":2},"fn_name":null},{"line":109,"address":[506534],"length":1,"stats":{"Line":1},"fn_name":null},{"line":114,"address":[507216,509269],"length":1,"stats":{"Line":1},"fn_name":"fmt"},{"line":115,"address":[507249,507450],"length":1,"stats":{"Line":1},"fn_name":null},{"line":116,"address":[507628,507347],"length":1,"stats":{"Line":1},"fn_name":null},{"line":117,"address":[507790,507497],"length":1,"stats":{"Line":1},"fn_name":null},{"line":118,"address":[507952,507660],"length":1,"stats":{"Line":1},"fn_name":null},{"line":119,"address":[507822,508117],"length":1,"stats":{"Line":1},"fn_name":null},{"line":120,"address":[507984,508279],"length":1,"stats":{"Line":1},"fn_name":null},{"line":121,"address":[508441,508149],"length":1,"stats":{"Line":1},"fn_name":null},{"line":122,"address":[508606,508311],"length":1,"stats":{"Line":1},"fn_name":null},{"line":123,"address":[508769,508473],"length":1,"stats":{"Line":1},"fn_name":null},{"line":124,"address":[508638,508876],"length":1,"stats":{"Line":1},"fn_name":null},{"line":125,"address":[508801,509215,508903],"length":1,"stats":{"Line":1},"fn_name":null},{"line":126,"address":[509374,509112],"length":1,"stats":{"Line":1},"fn_name":null},{"line":127,"address":[509401,509696,509313],"length":1,"stats":{"Line":1},"fn_name":null},{"line":128,"address":[510029,509618,509750],"length":1,"stats":{"Line":1},"fn_name":null},{"line":129,"address":[509959],"length":1,"stats":{"Line":1},"fn_name":null},{"line":137,"address":[510096,511624,515133],"length":1,"stats":{"Line":1},"fn_name":"deserialize_nebula_certificate"},{"line":138,"address":[510173],"length":1,"stats":{"Line":1},"fn_name":null},{"line":139,"address":[510367],"length":1,"stats":{"Line":1},"fn_name":null},{"line":142,"address":[510251],"length":1,"stats":{"Line":1},"fn_name":null},{"line":144,"address":[510295,510630,510481],"length":1,"stats":{"Line":2},"fn_name":null},{"line":146,"address":[510541,510856,511034],"length":1,"stats":{"Line":2},"fn_name":null},{"line":148,"address":[510996,511181],"length":1,"stats":{"Line":2},"fn_name":null},{"line":149,"address":[511218],"length":1,"stats":{"Line":1},"fn_name":null},{"line":152,"address":[511191,511325],"length":1,"stats":{"Line":2},"fn_name":null},{"line":153,"address":[511358],"length":1,"stats":{"Line":1},"fn_name":null},{"line":159,"address":[513142],"length":1,"stats":{"Line":1},"fn_name":null},{"line":160,"address":[512814],"length":1,"stats":{"Line":1},"fn_name":null},{"line":161,"address":[511335],"length":1,"stats":{"Line":1},"fn_name":null},{"line":162,"address":[511745,511635,511481,511581],"length":1,"stats":{"Line":3},"fn_name":null},{"line":163,"address":[512099,511948,511699],"length":1,"stats":{"Line":2},"fn_name":null},{"line":164,"address":[512376,512053],"length":1,"stats":{"Line":2},"fn_name":null},{"line":165,"address":[512558,512469],"length":1,"stats":{"Line":2},"fn_name":null},{"line":166,"address":[512615],"length":1,"stats":{"Line":1},"fn_name":null},{"line":167,"address":[512699],"length":1,"stats":{"Line":1},"fn_name":null},{"line":168,"address":[512718],"length":1,"stats":{"Line":1},"fn_name":null},{"line":169,"address":[512729],"length":1,"stats":{"Line":1},"fn_name":null},{"line":171,"address":[513045],"length":1,"stats":{"Line":1},"fn_name":null},{"line":175,"address":[513217],"length":1,"stats":{"Line":1},"fn_name":null},{"line":177,"address":[513399],"length":1,"stats":{"Line":1},"fn_name":null},{"line":178,"address":[513500],"length":1,"stats":{"Line":1},"fn_name":null},{"line":183,"address":[514461],"length":1,"stats":{"Line":1},"fn_name":null},{"line":193,"address":[515168],"length":1,"stats":{"Line":0},"fn_name":"fmt"},{"line":195,"address":[515186],"length":1,"stats":{"Line":0},"fn_name":null},{"line":205,"address":[515248,515725],"length":1,"stats":{"Line":1},"fn_name":"deserialize_nebula_certificate_from_pem"},{"line":206,"address":[515281,515445],"length":1,"stats":{"Line":2},"fn_name":null},{"line":207,"address":[515577,515419],"length":1,"stats":{"Line":2},"fn_name":null},{"line":208,"address":[515609],"length":1,"stats":{"Line":0},"fn_name":null},{"line":210,"address":[515583,515702],"length":1,"stats":{"Line":2},"fn_name":null},{"line":214,"address":[515760,515971],"length":1,"stats":{"Line":1},"fn_name":"serialize_x25519_private"},{"line":215,"address":[516110,515898,516040],"length":1,"stats":{"Line":3},"fn_name":null},{"line":216,"address":[515803],"length":1,"stats":{"Line":1},"fn_name":null},{"line":217,"address":[515838],"length":1,"stats":{"Line":1},"fn_name":null},{"line":218,"address":[515857],"length":1,"stats":{"Line":0},"fn_name":null},{"line":222,"address":[516387,516176],"length":1,"stats":{"Line":1},"fn_name":"serialize_x25519_public"},{"line":223,"address":[516314,516526,516456],"length":1,"stats":{"Line":3},"fn_name":null},{"line":224,"address":[516219],"length":1,"stats":{"Line":1},"fn_name":null},{"line":225,"address":[516254],"length":1,"stats":{"Line":1},"fn_name":null},{"line":226,"address":[516273],"length":1,"stats":{"Line":0},"fn_name":null},{"line":232,"address":[516592,517090],"length":1,"stats":{"Line":1},"fn_name":"deserialize_x25519_private"},{"line":233,"address":[516625,516786],"length":1,"stats":{"Line":2},"fn_name":null},{"line":234,"address":[516918,516760],"length":1,"stats":{"Line":2},"fn_name":null},{"line":235,"address":[517027],"length":1,"stats":{"Line":0},"fn_name":null},{"line":237,"address":[516929],"length":1,"stats":{"Line":1},"fn_name":null},{"line":243,"address":[517618,517120],"length":1,"stats":{"Line":1},"fn_name":"deserialize_x25519_public"},{"line":244,"address":[517153,517314],"length":1,"stats":{"Line":2},"fn_name":null},{"line":245,"address":[517446,517288],"length":1,"stats":{"Line":2},"fn_name":null},{"line":246,"address":[517555],"length":1,"stats":{"Line":0},"fn_name":null},{"line":248,"address":[517457],"length":1,"stats":{"Line":1},"fn_name":null},{"line":252,"address":[517648,517859],"length":1,"stats":{"Line":1},"fn_name":"serialize_ed25519_private"},{"line":253,"address":[517928,517998,517786],"length":1,"stats":{"Line":3},"fn_name":null},{"line":254,"address":[517691],"length":1,"stats":{"Line":1},"fn_name":null},{"line":255,"address":[517726],"length":1,"stats":{"Line":1},"fn_name":null},{"line":256,"address":[517745],"length":1,"stats":{"Line":0},"fn_name":null},{"line":260,"address":[518064,518275],"length":1,"stats":{"Line":1},"fn_name":"serialize_ed25519_public"},{"line":261,"address":[518202,518414,518344],"length":1,"stats":{"Line":3},"fn_name":null},{"line":262,"address":[518107],"length":1,"stats":{"Line":1},"fn_name":null},{"line":263,"address":[518142],"length":1,"stats":{"Line":1},"fn_name":null},{"line":264,"address":[518161],"length":1,"stats":{"Line":0},"fn_name":null},{"line":270,"address":[518978,518480],"length":1,"stats":{"Line":1},"fn_name":"deserialize_ed25519_private"},{"line":271,"address":[518513,518674],"length":1,"stats":{"Line":2},"fn_name":null},{"line":272,"address":[518806,518648],"length":1,"stats":{"Line":2},"fn_name":null},{"line":273,"address":[518915],"length":1,"stats":{"Line":0},"fn_name":null},{"line":275,"address":[518817],"length":1,"stats":{"Line":1},"fn_name":null},{"line":281,"address":[519506,519008],"length":1,"stats":{"Line":1},"fn_name":"deserialize_ed25519_public"},{"line":282,"address":[519041,519202],"length":1,"stats":{"Line":2},"fn_name":null},{"line":283,"address":[519334,519176],"length":1,"stats":{"Line":2},"fn_name":null},{"line":284,"address":[519443],"length":1,"stats":{"Line":0},"fn_name":null},{"line":286,"address":[519345],"length":1,"stats":{"Line":1},"fn_name":null},{"line":293,"address":[519536,519956,520258],"length":1,"stats":{"Line":1},"fn_name":"sign"},{"line":294,"address":[519569],"length":1,"stats":{"Line":1},"fn_name":null},{"line":295,"address":[519593,519656],"length":1,"stats":{"Line":2},"fn_name":null},{"line":296,"address":[519669],"length":1,"stats":{"Line":1},"fn_name":null},{"line":298,"address":[519996],"length":1,"stats":{"Line":1},"fn_name":null},{"line":299,"address":[520233],"length":1,"stats":{"Line":1},"fn_name":null},{"line":305,"address":[520693,521138,520288],"length":1,"stats":{"Line":1},"fn_name":"check_signature"},{"line":306,"address":[520331],"length":1,"stats":{"Line":1},"fn_name":null},{"line":307,"address":[520355,520418],"length":1,"stats":{"Line":2},"fn_name":null},{"line":308,"address":[520431],"length":1,"stats":{"Line":1},"fn_name":null},{"line":310,"address":[520986,520725],"length":1,"stats":{"Line":2},"fn_name":null},{"line":312,"address":[521200,521092,520955],"length":1,"stats":{"Line":3},"fn_name":null},{"line":316,"address":[521296],"length":1,"stats":{"Line":1},"fn_name":"expired"},{"line":317,"address":[521318],"length":1,"stats":{"Line":1},"fn_name":null},{"line":323,"address":[521392],"length":1,"stats":{"Line":0},"fn_name":"verify"},{"line":324,"address":[521467],"length":1,"stats":{"Line":0},"fn_name":null},{"line":325,"address":[521544],"length":1,"stats":{"Line":0},"fn_name":null},{"line":328,"address":[521668,521486,521568,521701],"length":1,"stats":{"Line":0},"fn_name":null},{"line":330,"address":[521685],"length":1,"stats":{"Line":0},"fn_name":null},{"line":331,"address":[521747],"length":1,"stats":{"Line":0},"fn_name":null},{"line":334,"address":[521731],"length":1,"stats":{"Line":0},"fn_name":null},{"line":335,"address":[521823],"length":1,"stats":{"Line":0},"fn_name":null},{"line":338,"address":[522015,521839,521767],"length":1,"stats":{"Line":0},"fn_name":null},{"line":339,"address":[522125],"length":1,"stats":{"Line":0},"fn_name":null},{"line":342,"address":[522093],"length":1,"stats":{"Line":0},"fn_name":null},{"line":346,"address":[522144],"length":1,"stats":{"Line":0},"fn_name":"check_root_constraints"},{"line":348,"address":[522190],"length":1,"stats":{"Line":0},"fn_name":null},{"line":349,"address":[522236],"length":1,"stats":{"Line":0},"fn_name":null},{"line":353,"address":[522217],"length":1,"stats":{"Line":0},"fn_name":null},{"line":354,"address":[522278],"length":1,"stats":{"Line":0},"fn_name":null},{"line":358,"address":[522258],"length":1,"stats":{"Line":0},"fn_name":null},{"line":359,"address":[522319],"length":1,"stats":{"Line":0},"fn_name":null},{"line":360,"address":[522405],"length":1,"stats":{"Line":0},"fn_name":null},{"line":361,"address":[522441],"length":1,"stats":{"Line":0},"fn_name":null},{"line":367,"address":[522290],"length":1,"stats":{"Line":0},"fn_name":null},{"line":368,"address":[522485],"length":1,"stats":{"Line":0},"fn_name":null},{"line":369,"address":[522564],"length":1,"stats":{"Line":0},"fn_name":null},{"line":370,"address":[522612],"length":1,"stats":{"Line":0},"fn_name":null},{"line":376,"address":[522456],"length":1,"stats":{"Line":0},"fn_name":null},{"line":377,"address":[522637],"length":1,"stats":{"Line":0},"fn_name":null},{"line":378,"address":[522716],"length":1,"stats":{"Line":0},"fn_name":null},{"line":379,"address":[522764],"length":1,"stats":{"Line":0},"fn_name":null},{"line":384,"address":[522622],"length":1,"stats":{"Line":0},"fn_name":null},{"line":393,"address":[522784,523247],"length":1,"stats":{"Line":0},"fn_name":"verify_private_key"},{"line":394,"address":[522830],"length":1,"stats":{"Line":0},"fn_name":null},{"line":396,"address":[522864],"length":1,"stats":{"Line":0},"fn_name":null},{"line":397,"address":[523048],"length":1,"stats":{"Line":0},"fn_name":null},{"line":400,"address":[522884],"length":1,"stats":{"Line":0},"fn_name":null},{"line":402,"address":[522968,523093],"length":1,"stats":{"Line":0},"fn_name":null},{"line":403,"address":[523287],"length":1,"stats":{"Line":0},"fn_name":null},{"line":406,"address":[523273],"length":1,"stats":{"Line":0},"fn_name":null},{"line":409,"address":[522844],"length":1,"stats":{"Line":0},"fn_name":null},{"line":410,"address":[523490],"length":1,"stats":{"Line":0},"fn_name":null},{"line":413,"address":[523333],"length":1,"stats":{"Line":0},"fn_name":null},{"line":414,"address":[523471],"length":1,"stats":{"Line":0},"fn_name":null},{"line":415,"address":[523536],"length":1,"stats":{"Line":0},"fn_name":null},{"line":418,"address":[523522],"length":1,"stats":{"Line":0},"fn_name":null},{"line":427,"address":[524705,523584],"length":1,"stats":{"Line":1},"fn_name":"get_raw_details"},{"line":430,"address":[523623],"length":1,"stats":{"Line":1},"fn_name":null},{"line":431,"address":[523652],"length":1,"stats":{"Line":1},"fn_name":null},{"line":432,"address":[523711],"length":1,"stats":{"Line":1},"fn_name":null},{"line":433,"address":[523858,523767],"length":1,"stats":{"Line":2},"fn_name":null},{"line":434,"address":[524039,523959],"length":1,"stats":{"Line":2},"fn_name":null},{"line":435,"address":[524149],"length":1,"stats":{"Line":1},"fn_name":null},{"line":436,"address":[524295],"length":1,"stats":{"Line":1},"fn_name":null},{"line":437,"address":[524349],"length":1,"stats":{"Line":1},"fn_name":null},{"line":438,"address":[524362,524428],"length":1,"stats":{"Line":2},"fn_name":null},{"line":441,"address":[524678,524912,524784],"length":1,"stats":{"Line":3},"fn_name":null},{"line":442,"address":[524933],"length":1,"stats":{"Line":1},"fn_name":null},{"line":443,"address":[525033],"length":1,"stats":{"Line":1},"fn_name":null},{"line":446,"address":[524880,525241,525135],"length":1,"stats":{"Line":3},"fn_name":null},{"line":447,"address":[525262],"length":1,"stats":{"Line":1},"fn_name":null},{"line":448,"address":[525362],"length":1,"stats":{"Line":1},"fn_name":null},{"line":457,"address":[525456,525671],"length":1,"stats":{"Line":1},"fn_name":"serialize"},{"line":459,"address":[525499],"length":1,"stats":{"Line":1},"fn_name":null},{"line":460,"address":[525536],"length":1,"stats":{"Line":1},"fn_name":null},{"line":463,"address":[525652],"length":1,"stats":{"Line":1},"fn_name":null},{"line":464,"address":[525739,525797],"length":1,"stats":{"Line":2},"fn_name":null},{"line":465,"address":[525997,525826],"length":1,"stats":{"Line":1},"fn_name":null},{"line":467,"address":[525886],"length":1,"stats":{"Line":1},"fn_name":null},{"line":473,"address":[526160,526511],"length":1,"stats":{"Line":1},"fn_name":"serialize_to_pem"},{"line":474,"address":[526302,526185],"length":1,"stats":{"Line":1},"fn_name":null},{"line":476,"address":[526586,526652,526420],"length":1,"stats":{"Line":3},"fn_name":null},{"line":477,"address":[526270],"length":1,"stats":{"Line":1},"fn_name":null},{"line":478,"address":[526394],"length":1,"stats":{"Line":1},"fn_name":null},{"line":485,"address":[526752,527296,527265],"length":1,"stats":{"Line":1},"fn_name":"sha256sum"},{"line":486,"address":[526890,526776],"length":1,"stats":{"Line":1},"fn_name":null},{"line":488,"address":[526879],"length":1,"stats":{"Line":1},"fn_name":null},{"line":489,"address":[526990],"length":1,"stats":{"Line":1},"fn_name":null},{"line":491,"address":[527047],"length":1,"stats":{"Line":1},"fn_name":null},{"line":521,"address":[527312],"length":1,"stats":{"Line":0},"fn_name":"net_match"},{"line":522,"address":[527426,527362],"length":1,"stats":{"Line":0},"fn_name":null},{"line":523,"address":[527436],"length":1,"stats":{"Line":0},"fn_name":null},{"line":524,"address":[527453],"length":1,"stats":{"Line":0},"fn_name":null},{"line":527,"address":[527419],"length":1,"stats":{"Line":0},"fn_name":null}],"covered":130,"coverable":200},{"path":["/","home","core","prj","e3t","trifid","trifid-pki","src","cert_codec.rs"],"content":"// Automatically generated rust module for 'cert_codec.proto' file\n\n#![allow(non_snake_case)]\n#![allow(non_upper_case_globals)]\n#![allow(non_camel_case_types)]\n#![allow(unused_imports)]\n#![allow(unknown_lints)]\n#![allow(clippy::all)]\n#![cfg_attr(rustfmt, rustfmt_skip)]\n#![allow(clippy::pedantic)]\n\nuse quick_protobuf::{MessageInfo, MessageRead, MessageWrite, BytesReader, Writer, WriterBackend, Result};\nuse quick_protobuf::sizeofs::*;\nuse super::*;\n\n#[allow(clippy::derive_partial_eq_without_eq)]\n#[derive(Debug, Default, PartialEq, Clone)]\npub struct RawNebulaCertificate {\n    pub Details: Option\u003ccert_codec::RawNebulaCertificateDetails\u003e,\n    pub Signature: Vec\u003cu8\u003e,\n}\n\nimpl\u003c'a\u003e MessageRead\u003c'a\u003e for RawNebulaCertificate {\n    fn from_reader(r: \u0026mut BytesReader, bytes: \u0026'a [u8]) -\u003e Result\u003cSelf\u003e {\n        let mut msg = Self::default();\n        while !r.is_eof() {\n            match r.next_tag(bytes) {\n                Ok(10) =\u003e msg.Details = Some(r.read_message::\u003ccert_codec::RawNebulaCertificateDetails\u003e(bytes)?),\n                Ok(18) =\u003e msg.Signature = r.read_bytes(bytes)?.to_owned(),\n                Ok(t) =\u003e { r.read_unknown(bytes, t)?; }\n                Err(e) =\u003e return Err(e),\n            }\n        }\n        Ok(msg)\n    }\n}\n\nimpl MessageWrite for RawNebulaCertificate {\n    fn get_size(\u0026self) -\u003e usize {\n        0\n        + self.Details.as_ref().map_or(0, |m| 1 + sizeof_len((m).get_size()))\n        + if self.Signature.is_empty() { 0 } else { 1 + sizeof_len((\u0026self.Signature).len()) }\n    }\n\n    fn write_message\u003cW: WriterBackend\u003e(\u0026self, w: \u0026mut Writer\u003cW\u003e) -\u003e Result\u003c()\u003e {\n        if let Some(ref s) = self.Details { w.write_with_tag(10, |w| w.write_message(s))?; }\n        if !self.Signature.is_empty() { w.write_with_tag(18, |w| w.write_bytes(\u0026**\u0026self.Signature))?; }\n        Ok(())\n    }\n}\n\n#[allow(clippy::derive_partial_eq_without_eq)]\n#[derive(Debug, Default, PartialEq, Clone)]\npub struct RawNebulaCertificateDetails {\n    pub Name: String,\n    pub Ips: Vec\u003cu32\u003e,\n    pub Subnets: Vec\u003cu32\u003e,\n    pub Groups: Vec\u003cString\u003e,\n    pub NotBefore: i64,\n    pub NotAfter: i64,\n    pub PublicKey: Vec\u003cu8\u003e,\n    pub IsCA: bool,\n    pub Issuer: Vec\u003cu8\u003e,\n}\n\nimpl\u003c'a\u003e MessageRead\u003c'a\u003e for RawNebulaCertificateDetails {\n    fn from_reader(r: \u0026mut BytesReader, bytes: \u0026'a [u8]) -\u003e Result\u003cSelf\u003e {\n        let mut msg = Self::default();\n        while !r.is_eof() {\n            match r.next_tag(bytes) {\n                Ok(10) =\u003e msg.Name = r.read_string(bytes)?.to_owned(),\n                Ok(18) =\u003e msg.Ips = r.read_packed(bytes, |r, bytes| Ok(r.read_uint32(bytes)?))?,\n                Ok(26) =\u003e msg.Subnets = r.read_packed(bytes, |r, bytes| Ok(r.read_uint32(bytes)?))?,\n                Ok(34) =\u003e msg.Groups.push(r.read_string(bytes)?.to_owned()),\n                Ok(40) =\u003e msg.NotBefore = r.read_int64(bytes)?,\n                Ok(48) =\u003e msg.NotAfter = r.read_int64(bytes)?,\n                Ok(58) =\u003e msg.PublicKey = r.read_bytes(bytes)?.to_owned(),\n                Ok(64) =\u003e msg.IsCA = r.read_bool(bytes)?,\n                Ok(74) =\u003e msg.Issuer = r.read_bytes(bytes)?.to_owned(),\n                Ok(t) =\u003e { r.read_unknown(bytes, t)?; }\n                Err(e) =\u003e return Err(e),\n            }\n        }\n        Ok(msg)\n    }\n}\n\nimpl MessageWrite for RawNebulaCertificateDetails {\n    fn get_size(\u0026self) -\u003e usize {\n        0\n        + if self.Name == String::default() { 0 } else { 1 + sizeof_len((\u0026self.Name).len()) }\n        + if self.Ips.is_empty() { 0 } else { 1 + sizeof_len(self.Ips.iter().map(|s| sizeof_varint(*(s) as u64)).sum::\u003cusize\u003e()) }\n        + if self.Subnets.is_empty() { 0 } else { 1 + sizeof_len(self.Subnets.iter().map(|s| sizeof_varint(*(s) as u64)).sum::\u003cusize\u003e()) }\n        + self.Groups.iter().map(|s| 1 + sizeof_len((s).len())).sum::\u003cusize\u003e()\n        + if self.NotBefore == 0i64 { 0 } else { 1 + sizeof_varint(*(\u0026self.NotBefore) as u64) }\n        + if self.NotAfter == 0i64 { 0 } else { 1 + sizeof_varint(*(\u0026self.NotAfter) as u64) }\n        + if self.PublicKey.is_empty() { 0 } else { 1 + sizeof_len((\u0026self.PublicKey).len()) }\n        + if self.IsCA == false { 0 } else { 1 + sizeof_varint(*(\u0026self.IsCA) as u64) }\n        + if self.Issuer.is_empty() { 0 } else { 1 + sizeof_len((\u0026self.Issuer).len()) }\n    }\n\n    fn write_message\u003cW: WriterBackend\u003e(\u0026self, w: \u0026mut Writer\u003cW\u003e) -\u003e Result\u003c()\u003e {\n        if self.Name != String::default() { w.write_with_tag(10, |w| w.write_string(\u0026**\u0026self.Name))?; }\n        w.write_packed_with_tag(18, \u0026self.Ips, |w, m| w.write_uint32(*m), \u0026|m| sizeof_varint(*(m) as u64))?;\n        w.write_packed_with_tag(26, \u0026self.Subnets, |w, m| w.write_uint32(*m), \u0026|m| sizeof_varint(*(m) as u64))?;\n        for s in \u0026self.Groups { w.write_with_tag(34, |w| w.write_string(\u0026**s))?; }\n        if self.NotBefore != 0i64 { w.write_with_tag(40, |w| w.write_int64(*\u0026self.NotBefore))?; }\n        if self.NotAfter != 0i64 { w.write_with_tag(48, |w| w.write_int64(*\u0026self.NotAfter))?; }\n        if !self.PublicKey.is_empty() { w.write_with_tag(58, |w| w.write_bytes(\u0026**\u0026self.PublicKey))?; }\n        if self.IsCA != false { w.write_with_tag(64, |w| w.write_bool(*\u0026self.IsCA))?; }\n        if !self.Issuer.is_empty() { w.write_with_tag(74, |w| w.write_bytes(\u0026**\u0026self.Issuer))?; }\n        Ok(())\n    }\n}\n\n","traces":[],"covered":0,"coverable":0},{"path":["/","home","core","prj","e3t","trifid","trifid-pki","src","lib.rs"],"content":"//! # trifid-pki\n//! trifid-pki is a crate for interacting with the Nebula PKI system. It was created to prevent the need to make constant CLI calls for signing operations in Nebula.\n//! It is designed to be interoperable with the original Go implementation and as such has some oddities with key management to ensure compatability.\n//!\n//! This crate has not received any format security audits, however the underlying crates used for actual cryptographic operations (ed25519-dalek and curve25519-dalek) have been audited with no major issues.\n\n#![warn(clippy::pedantic)]\n#![warn(clippy::nursery)]\n#![deny(clippy::unwrap_used)]\n#![deny(clippy::expect_used)]\n#![deny(missing_docs)]\n#![deny(clippy::missing_errors_doc)]\n#![deny(clippy::missing_panics_doc)]\n#![deny(clippy::missing_safety_doc)]\n#![allow(clippy::must_use_candidate)]\n#![allow(clippy::too_many_lines)]\n#![allow(clippy::module_name_repetitions)]\n\n\nextern crate core;\n\npub mod ca;\npub mod cert;\n#[cfg(not(tarpaulin_include))]\npub(crate) mod cert_codec;\n#[cfg(test)]\n#[macro_use]\npub mod test;","traces":[],"covered":0,"coverable":0},{"path":["/","home","core","prj","e3t","trifid","trifid-pki","src","test.rs"],"content":"#![allow(clippy::unwrap_used)]\n#![allow(clippy::expect_used)]\n\nuse crate::netmask;\nuse std::net::Ipv4Addr;\nuse std::ops::{Add, Sub};\nuse std::time::{Duration, SystemTime, SystemTimeError, UNIX_EPOCH};\nuse ipnet::Ipv4Net;\nuse crate::cert::{CertificateValidity, deserialize_ed25519_private, deserialize_ed25519_public, deserialize_nebula_certificate, deserialize_nebula_certificate_from_pem, deserialize_x25519_private, deserialize_x25519_public, NebulaCertificate, NebulaCertificateDetails, serialize_ed25519_private, serialize_ed25519_public, serialize_x25519_private, serialize_x25519_public};\nuse std::str::FromStr;\nuse ed25519_dalek::{SigningKey, VerifyingKey};\nuse quick_protobuf::{MessageWrite, Writer};\nuse rand::rngs::OsRng;\nuse crate::ca::NebulaCAPool;\nuse crate::cert_codec::{RawNebulaCertificate, RawNebulaCertificateDetails};\n\n/// This is a cert that we (e3team) actually use in production, and it's a known-good certificate.\npub const KNOWN_GOOD_CERT: \u0026[u8; 258] = b\"-----BEGIN NEBULA CERTIFICATE-----\\nCkkKF2UzdGVhbSBJbnRlcm5hbCBOZXR3b3JrKJWev5wGMJWFxKsGOiCvpwoHyKY5\\n8Q5+2XxDjtoCf/zlNY/EUdB8bwXQSwEo50ABEkB0Dx76lkMqc3IyH5+ml2dKjTyv\\nB4Jiw6x3abf5YZcf8rDuVEgQpvFdJmo3xJyIb3C9vKZ6kXsUxjw6s1JdWgkA\\n-----END NEBULA CERTIFICATE-----\";\n\n#[test]\nfn certificate_serialization() {\n    let before = round_systime_to_secs(SystemTime::now() - Duration::from_secs(60)).unwrap();\n    let after = round_systime_to_secs(SystemTime::now() + Duration::from_secs(60)).unwrap();\n    let pub_key = b\"1234567890abcedfghij1234567890ab\";\n\n    let cert = NebulaCertificate {\n        details: NebulaCertificateDetails {\n            name: \"testing\".to_string(),\n            ips: vec![\n                netmask!(\"10.1.1.1\", \"255.255.255.0\"),\n                netmask!(\"10.1.1.2\", \"255.255.0.0\"),\n                netmask!(\"10.1.1.3\", \"255.0.0.0\")\n            ],\n            subnets: vec![\n                netmask!(\"9.1.1.1\", \"255.255.255.128\"),\n                netmask!(\"9.1.1.2\", \"255.255.255.0\"),\n                netmask!(\"9.1.1.3\", \"255.255.0.0\")\n            ],\n            groups: vec![\"test-group1\".to_string(), \"test-group2\".to_string(), \"test-group3\".to_string()],\n            not_before: before,\n            not_after: after,\n            public_key: *pub_key,\n            is_ca: false,\n            issuer: \"1234567890abcedfabcd1234567890ab\".to_string(),\n        },\n        signature: b\"1234567890abcedfghij1234567890ab\".to_vec(),\n    };\n\n    let bytes = cert.serialize().unwrap();\n\n    let deserialized = deserialize_nebula_certificate(\u0026bytes).unwrap();\n\n    assert_eq!(cert.signature, deserialized.signature);\n    assert_eq!(cert.details.name, deserialized.details.name);\n    assert_eq!(cert.details.not_before, deserialized.details.not_before);\n    assert_eq!(cert.details.not_after, deserialized.details.not_after);\n    assert_eq!(cert.details.public_key, deserialized.details.public_key);\n    assert_eq!(cert.details.is_ca, deserialized.details.is_ca);\n\n    assert_eq!(cert.details.ips.len(), deserialized.details.ips.len());\n    for item in \u0026cert.details.ips {\n        assert!(deserialized.details.ips.contains(item), \"deserialized does not contain from source\");\n    }\n\n    assert_eq!(cert.details.subnets.len(), deserialized.details.subnets.len());\n    for item in \u0026cert.details.subnets {\n        assert!(deserialized.details.subnets.contains(item), \"deserialized does not contain from source\");\n    }\n\n    assert_eq!(cert.details.groups.len(), deserialized.details.groups.len());\n    for item in \u0026cert.details.groups {\n        assert!(deserialized.details.groups.contains(item), \"deserialized does not contain from source\");\n    }\n}\n\n#[test]\nfn certificate_serialization_pem() {\n    let before = round_systime_to_secs(SystemTime::now() - Duration::from_secs(60)).unwrap();\n    let after = round_systime_to_secs(SystemTime::now() + Duration::from_secs(60)).unwrap();\n    let pub_key = b\"1234567890abcedfghij1234567890ab\";\n\n    let cert = NebulaCertificate {\n        details: NebulaCertificateDetails {\n            name: \"testing\".to_string(),\n            ips: vec![\n                netmask!(\"10.1.1.1\", \"255.255.255.0\"),\n                netmask!(\"10.1.1.2\", \"255.255.0.0\"),\n                netmask!(\"10.1.1.3\", \"255.0.0.0\")\n            ],\n            subnets: vec![\n                netmask!(\"9.1.1.1\", \"255.255.255.128\"),\n                netmask!(\"9.1.1.2\", \"255.255.255.0\"),\n                netmask!(\"9.1.1.3\", \"255.255.0.0\")\n            ],\n            groups: vec![\"test-group1\".to_string(), \"test-group2\".to_string(), \"test-group3\".to_string()],\n            not_before: before,\n            not_after: after,\n            public_key: *pub_key,\n            is_ca: false,\n            issuer: \"1234567890abcedfabcd1234567890ab\".to_string(),\n        },\n        signature: b\"1234567890abcedfghij1234567890ab\".to_vec(),\n    };\n\n    let bytes = cert.serialize_to_pem().unwrap();\n\n    let deserialized = deserialize_nebula_certificate_from_pem(\u0026bytes).unwrap();\n\n    assert_eq!(cert.signature, deserialized.signature);\n    assert_eq!(cert.details.name, deserialized.details.name);\n    assert_eq!(cert.details.not_before, deserialized.details.not_before);\n    assert_eq!(cert.details.not_after, deserialized.details.not_after);\n    assert_eq!(cert.details.public_key, deserialized.details.public_key);\n    assert_eq!(cert.details.is_ca, deserialized.details.is_ca);\n\n    assert_eq!(cert.details.ips.len(), deserialized.details.ips.len());\n    for item in \u0026cert.details.ips {\n        assert!(deserialized.details.ips.contains(item), \"deserialized does not contain from source\");\n    }\n\n    assert_eq!(cert.details.subnets.len(), deserialized.details.subnets.len());\n    for item in \u0026cert.details.subnets {\n        assert!(deserialized.details.subnets.contains(item), \"deserialized does not contain from source\");\n    }\n\n    assert_eq!(cert.details.groups.len(), deserialized.details.groups.len());\n    for item in \u0026cert.details.groups {\n        assert!(deserialized.details.groups.contains(item), \"deserialized does not contain from source\");\n    }\n}\n\n#[test]\nfn cert_signing() {\n    let before = round_systime_to_secs(SystemTime::now() - Duration::from_secs(60)).unwrap();\n    let after = round_systime_to_secs(SystemTime::now() + Duration::from_secs(60)).unwrap();\n    let pub_key = b\"1234567890abcedfghij1234567890ab\";\n\n    let mut cert = NebulaCertificate {\n        details: NebulaCertificateDetails {\n            name: \"testing\".to_string(),\n            ips: vec![\n                netmask!(\"10.1.1.1\", \"255.255.255.0\"),\n                netmask!(\"10.1.1.2\", \"255.255.0.0\"),\n                netmask!(\"10.1.1.3\", \"255.0.0.0\")\n            ],\n            subnets: vec![\n                netmask!(\"9.1.1.1\", \"255.255.255.128\"),\n                netmask!(\"9.1.1.2\", \"255.255.255.0\"),\n                netmask!(\"9.1.1.3\", \"255.255.0.0\")\n            ],\n            groups: vec![\"test-group1\".to_string(), \"test-group2\".to_string(), \"test-group3\".to_string()],\n            not_before: before,\n            not_after: after,\n            public_key: *pub_key,\n            is_ca: false,\n            issuer: \"1234567890abcedfabcd1234567890ab\".to_string(),\n        },\n        signature: b\"1234567890abcedfghij1234567890ab\".to_vec(),\n    };\n\n    let mut csprng = OsRng;\n    let key = SigningKey::generate(\u0026mut csprng);\n\n    assert!(cert.check_signature(\u0026key.verifying_key()).is_err());\n    cert.sign(\u0026key).unwrap();\n    assert!(cert.check_signature(\u0026key.verifying_key()).unwrap());\n}\n\n#[test]\nfn cert_expiry() {\n    let cert = NebulaCertificate {\n        details: NebulaCertificateDetails {\n            name: String::new(),\n            ips: vec![],\n            subnets: vec![],\n            groups: vec![],\n            not_before: SystemTime::now().sub(Duration::from_secs(60)),\n            not_after: SystemTime::now().add(Duration::from_secs(60)),\n            public_key: [0u8; 32],\n            is_ca: false,\n            issuer: String::new(),\n        },\n        signature: vec![],\n    };\n\n    assert!(cert.expired(SystemTime::now().add(Duration::from_secs(60 * 60 * 60))));\n    assert!(cert.expired(SystemTime::now().sub(Duration::from_secs(60 * 60 * 60))));\n    assert!(!cert.expired(SystemTime::now()));\n}\n\n#[test]\nfn cert_display() {\n    let cert = NebulaCertificate {\n        details: NebulaCertificateDetails {\n            name: String::new(),\n            ips: vec![],\n            subnets: vec![],\n            groups: vec![],\n            not_before: SystemTime::now().sub(Duration::from_secs(60)),\n            not_after: SystemTime::now().add(Duration::from_secs(60)),\n            public_key: [0u8; 32],\n            is_ca: false,\n            issuer: String::new(),\n        },\n        signature: vec![],\n    };\n    println!(\"{cert}\");\n}\n\n#[test]\n#[should_panic]\nfn cert_deserialize_empty_bytes() {\n    deserialize_nebula_certificate(\u0026[]).unwrap();\n}\n\n#[test]\nfn cert_deserialize_unpaired_ips() {\n    let broken_cert = RawNebulaCertificate {\n        Details: Some(RawNebulaCertificateDetails {\n            Name: String::new(),\n            Ips: vec![0],\n            Subnets: vec![],\n            Groups: vec![],\n            NotBefore: 0,\n            NotAfter: 0,\n            PublicKey: vec![],\n            IsCA: false,\n            Issuer: vec![],\n        }),\n        Signature: vec![],\n    };\n    let mut bytes = vec![];\n    let mut writer = Writer::new(\u0026mut bytes);\n    broken_cert.write_message(\u0026mut writer).unwrap();\n\n    deserialize_nebula_certificate(\u0026bytes).unwrap_err();\n}\n\n#[test]\nfn cert_deserialize_unpaired_subnets() {\n    let broken_cert = RawNebulaCertificate {\n        Details: Some(RawNebulaCertificateDetails {\n            Name: String::new(),\n            Ips: vec![],\n            Subnets: vec![0],\n            Groups: vec![],\n            NotBefore: 0,\n            NotAfter: 0,\n            PublicKey: vec![],\n            IsCA: false,\n            Issuer: vec![],\n        }),\n        Signature: vec![],\n    };\n    let mut bytes = vec![];\n    let mut writer = Writer::new(\u0026mut bytes);\n    broken_cert.write_message(\u0026mut writer).unwrap();\n\n    deserialize_nebula_certificate(\u0026bytes).unwrap_err();\n}\n\n#[test]\nfn cert_deserialize_wrong_pubkey_len() {\n    let broken_cert = RawNebulaCertificate {\n        Details: Some(RawNebulaCertificateDetails {\n            Name: String::new(),\n            Ips: vec![],\n            Subnets: vec![],\n            Groups: vec![],\n            NotBefore: 0,\n            NotAfter: 0,\n            PublicKey: vec![0u8; 31],\n            IsCA: false,\n            Issuer: vec![],\n        }),\n        Signature: vec![],\n    };\n    let mut bytes = vec![];\n    let mut writer = Writer::new(\u0026mut bytes);\n    broken_cert.write_message(\u0026mut writer).unwrap();\n\n    deserialize_nebula_certificate(\u0026bytes).unwrap_err();\n\n    assert!(deserialize_nebula_certificate_from_pem(\u0026[0u8; 32]).is_err());\n}\n\n#[test]\nfn x25519_serialization() {\n    let bytes = [0u8; 32];\n    assert_eq!(deserialize_x25519_private(\u0026serialize_x25519_private(\u0026bytes)).unwrap(), bytes);\n    assert!(deserialize_x25519_private(\u0026[0u8; 32]).is_err());\n    assert_eq!(deserialize_x25519_public(\u0026serialize_x25519_public(\u0026bytes)).unwrap(), bytes);\n    assert!(deserialize_x25519_public(\u0026[0u8; 32]).is_err());\n}\n\n#[test]\nfn ed25519_serialization() {\n    let bytes = [0u8; 32];\n    assert_eq!(deserialize_ed25519_private(\u0026serialize_ed25519_private(\u0026bytes)).unwrap(), bytes);\n    assert!(deserialize_ed25519_private(\u0026[0u8; 32]).is_err());\n    assert_eq!(deserialize_ed25519_public(\u0026serialize_ed25519_public(\u0026bytes)).unwrap(), bytes);\n    assert!(deserialize_ed25519_public(\u0026[0u8; 32]).is_err());\n}\n\n#[test]\nfn cert_verify() {\n    let (ca_cert, ca_key, _ca_pub) = test_ca_cert(round_systime_to_secs(SystemTime::now()).unwrap(), round_systime_to_secs(SystemTime::now() + Duration::from_secs(60 * 60 * 10)).unwrap(), vec![], vec![], vec![\"groupa\".to_string()]);\n\n    let (cert, _, _) = test_cert(\u0026ca_cert, \u0026ca_key, SystemTime::now(), round_systime_to_secs(SystemTime::now() + Duration::from_secs(60 * 60 * 5)).unwrap(), vec![], vec![], vec![]);\n\n    let mut ca_pool = NebulaCAPool::new();\n    ca_pool.add_ca_certificate(\u0026ca_cert.serialize_to_pem().unwrap()).unwrap();\n\n    let fingerprint = cert.sha256sum().unwrap();\n    ca_pool.blocklist_fingerprint(\u0026fingerprint);\n\n    assert!(matches!(cert.verify(SystemTime::now(), \u0026ca_pool).unwrap(), CertificateValidity::Blocklisted));\n\n    ca_pool.reset_blocklist();\n\n    assert!(matches!(cert.verify(SystemTime::now() + Duration::from_secs(60 * 60 * 60), \u0026ca_pool).unwrap(), CertificateValidity::RootCertExpired));\n    assert!(matches!(cert.verify(SystemTime::now() + Duration::from_secs(60 * 60 * 6), \u0026ca_pool).unwrap(), CertificateValidity::CertExpired));\n\n    let (cert_with_bad_group, _, _) = test_cert(\u0026ca_cert, \u0026ca_key, round_systime_to_secs(SystemTime::now()).unwrap(), in_a_minute(), vec![], vec![], vec![\"group-not-present on parent\".to_string()]);\n    assert_eq!(cert_with_bad_group.verify(SystemTime::now(), \u0026ca_pool).unwrap(), CertificateValidity::GroupNotPresentOnSigner);\n\n    let (cert_with_good_group, _, _) = test_cert(\u0026ca_cert, \u0026ca_key, round_systime_to_secs(SystemTime::now()).unwrap(), in_a_minute(), vec![], vec![], vec![\"groupa\".to_string()]);\n    assert_eq!(cert_with_good_group.verify(SystemTime::now(), \u0026ca_pool).unwrap(), CertificateValidity::Ok);\n\n}\n\n#[test]\nfn cert_verify_ip() {\n    let ca_ip_1 = Ipv4Net::from_str(\"10.0.0.0/16\").unwrap();\n    let ca_ip_2 = Ipv4Net::from_str(\"192.168.0.0/24\").unwrap();\n\n    let (ca, ca_key, _ca_pub) = test_ca_cert(round_systime_to_secs(SystemTime::now()).unwrap(), round_systime_to_secs(SystemTime::now() + Duration::from_secs(60 * 60 * 10)).unwrap(), vec![ca_ip_1, ca_ip_2], vec![], vec![]);\n\n    let ca_pem = ca.serialize_to_pem().unwrap();\n\n    let mut ca_pool = NebulaCAPool::new();\n    ca_pool.add_ca_certificate(\u0026ca_pem).unwrap();\n\n    // ip is outside the network\n    let cip1 = netmask!(\"10.1.0.0\", \"255.255.255.0\");\n    let cip2 = netmask!(\"192.198.0.1\", \"255.255.0.0\");\n    let (cert, _, _) = test_cert(\u0026ca, \u0026ca_key, round_systime_to_secs(SystemTime::now()).unwrap(), round_systime_to_secs(SystemTime::now() + Duration::from_secs(60 * 60 * 5)).unwrap(), vec![cip1, cip2], vec![], vec![]);\n\n    assert_eq!(cert.verify(SystemTime::now(), \u0026ca_pool).unwrap(), CertificateValidity::IPNotPresentOnSigner);\n\n    // ip is outside the network - reversed order from above\n    let cip1 = netmask!(\"192.198.0.1\", \"255.255.255.0\");\n    let cip2 = netmask!(\"10.1.0.0\", \"255.255.255.0\");\n    let (cert, _, _) = test_cert(\u0026ca, \u0026ca_key, round_systime_to_secs(SystemTime::now()).unwrap(), round_systime_to_secs(SystemTime::now() + Duration::from_secs(60 * 60 * 5)).unwrap(), vec![cip1, cip2], vec![], vec![]);\n\n    assert_eq!(cert.verify(SystemTime::now(), \u0026ca_pool).unwrap(), CertificateValidity::IPNotPresentOnSigner);\n\n    // ip is within the network but mask is outside\n    let cip1 = netmask!(\"10.0.1.0\", \"255.254.0.0\");\n    let cip2 = netmask!(\"192.168.0.1\", \"255.255.255.0\");\n    let (cert, _, _) = test_cert(\u0026ca, \u0026ca_key, round_systime_to_secs(SystemTime::now()).unwrap(), round_systime_to_secs(SystemTime::now() + Duration::from_secs(60 * 60 * 5)).unwrap(), vec![cip1, cip2], vec![], vec![]);\n\n    assert_eq!(cert.verify(SystemTime::now(), \u0026ca_pool).unwrap(), CertificateValidity::IPNotPresentOnSigner);\n\n    // ip is within the network but mask is outside - reversed order from above\n    let cip1 = netmask!(\"192.168.0.1\", \"255.255.255.0\");\n    let cip2 = netmask!(\"10.0.1.0\", \"255.254.0.0\");\n    let (cert, _, _) = test_cert(\u0026ca, \u0026ca_key, round_systime_to_secs(SystemTime::now()).unwrap(), round_systime_to_secs(SystemTime::now() + Duration::from_secs(60 * 60 * 5)).unwrap(), vec![cip1, cip2], vec![], vec![]);\n\n    assert_eq!(cert.verify(SystemTime::now(), \u0026ca_pool).unwrap(), CertificateValidity::IPNotPresentOnSigner);\n\n    // ip and mask are within the network\n    let cip1 = netmask!(\"10.0.1.0\", \"255.255.0.0\");\n    let cip2 = netmask!(\"192.168.0.1\", \"255.255.255.128\");\n    let (cert, _, _) = test_cert(\u0026ca, \u0026ca_key, round_systime_to_secs(SystemTime::now()).unwrap(), round_systime_to_secs(SystemTime::now() + Duration::from_secs(60 * 60 * 5)).unwrap(), vec![cip1, cip2], vec![], vec![]);\n\n    assert_eq!(cert.verify(SystemTime::now(), \u0026ca_pool).unwrap(), CertificateValidity::Ok);\n\n    // Exact matches\n    let (cert, _, _) = test_cert(\u0026ca, \u0026ca_key, round_systime_to_secs(SystemTime::now()).unwrap(), round_systime_to_secs(SystemTime::now() + Duration::from_secs(60 * 60 * 5)).unwrap(), vec![ca_ip_1, ca_ip_2], vec![], vec![]);\n    assert_eq!(cert.verify(SystemTime::now(), \u0026ca_pool).unwrap(), CertificateValidity::Ok);\n\n    // Exact matches reversed\n    let (cert, _, _) = test_cert(\u0026ca, \u0026ca_key, round_systime_to_secs(SystemTime::now()).unwrap(), round_systime_to_secs(SystemTime::now() + Duration::from_secs(60 * 60 * 5)).unwrap(), vec![ca_ip_2, ca_ip_1], vec![], vec![]);\n    assert_eq!(cert.verify(SystemTime::now(), \u0026ca_pool).unwrap(), CertificateValidity::Ok);\n\n    // Exact matches reversed with just one\n    let (cert, _, _) = test_cert(\u0026ca, \u0026ca_key, round_systime_to_secs(SystemTime::now()).unwrap(), round_systime_to_secs(SystemTime::now() + Duration::from_secs(60 * 60 * 5)).unwrap(), vec![ca_ip_2], vec![], vec![]);\n    assert_eq!(cert.verify(SystemTime::now(), \u0026ca_pool).unwrap(), CertificateValidity::Ok);\n}\n\n#[test]\nfn cert_verify_subnet() {\n    let ca_ip_1 = Ipv4Net::from_str(\"10.0.0.0/16\").unwrap();\n    let ca_ip_2 = Ipv4Net::from_str(\"192.168.0.0/24\").unwrap();\n\n    let (ca, ca_key, _ca_pub) = test_ca_cert(round_systime_to_secs(SystemTime::now()).unwrap(), round_systime_to_secs(SystemTime::now() + Duration::from_secs(60 * 60 * 10)).unwrap(), vec![],vec![ca_ip_1, ca_ip_2], vec![]);\n\n    let ca_pem = ca.serialize_to_pem().unwrap();\n\n    let mut ca_pool = NebulaCAPool::new();\n    ca_pool.add_ca_certificate(\u0026ca_pem).unwrap();\n\n    // ip is outside the network\n    let cip1 = netmask!(\"10.1.0.0\", \"255.255.255.0\");\n    let cip2 = netmask!(\"192.198.0.1\", \"255.255.0.0\");\n    let (cert, _, _) = test_cert(\u0026ca, \u0026ca_key, round_systime_to_secs(SystemTime::now()).unwrap(), round_systime_to_secs(SystemTime::now() + Duration::from_secs(60 * 60 * 5)).unwrap(), vec![],vec![cip1, cip2], vec![]);\n\n    assert_eq!(cert.verify(SystemTime::now(), \u0026ca_pool).unwrap(), CertificateValidity::SubnetNotPresentOnSigner);\n\n    // ip is outside the network - reversed order from above\n    let cip1 = netmask!(\"192.198.0.1\", \"255.255.255.0\");\n    let cip2 = netmask!(\"10.1.0.0\", \"255.255.255.0\");\n    let (cert, _, _) = test_cert(\u0026ca, \u0026ca_key, round_systime_to_secs(SystemTime::now()).unwrap(), round_systime_to_secs(SystemTime::now() + Duration::from_secs(60 * 60 * 5)).unwrap(), vec![],vec![cip1, cip2], vec![]);\n\n    assert_eq!(cert.verify(SystemTime::now(), \u0026ca_pool).unwrap(), CertificateValidity::SubnetNotPresentOnSigner);\n\n    // ip is within the network but mask is outside\n    let cip1 = netmask!(\"10.0.1.0\", \"255.254.0.0\");\n    let cip2 = netmask!(\"192.168.0.1\", \"255.255.255.0\");\n    let (cert, _, _) = test_cert(\u0026ca, \u0026ca_key, round_systime_to_secs(SystemTime::now()).unwrap(), round_systime_to_secs(SystemTime::now() + Duration::from_secs(60 * 60 * 5)).unwrap(), vec![],vec![cip1, cip2], vec![]);\n\n    assert_eq!(cert.verify(SystemTime::now(), \u0026ca_pool).unwrap(), CertificateValidity::SubnetNotPresentOnSigner);\n\n    // ip is within the network but mask is outside - reversed order from above\n    let cip1 = netmask!(\"192.168.0.1\", \"255.255.255.0\");\n    let cip2 = netmask!(\"10.0.1.0\", \"255.254.0.0\");\n    let (cert, _, _) = test_cert(\u0026ca, \u0026ca_key, round_systime_to_secs(SystemTime::now()).unwrap(), round_systime_to_secs(SystemTime::now() + Duration::from_secs(60 * 60 * 5)).unwrap(), vec![cip1, cip2], vec![], vec![]);\n\n    assert_eq!(cert.verify(SystemTime::now(), \u0026ca_pool).unwrap(), CertificateValidity::SubnetNotPresentOnSigner);\n\n    // ip and mask are within the network\n    let cip1 = netmask!(\"10.0.1.0\", \"255.255.0.0\");\n    let cip2 = netmask!(\"192.168.0.1\", \"255.255.255.128\");\n    let (cert, _, _) = test_cert(\u0026ca, \u0026ca_key, round_systime_to_secs(SystemTime::now()).unwrap(), round_systime_to_secs(SystemTime::now() + Duration::from_secs(60 * 60 * 5)).unwrap(), vec![], vec![cip1, cip2], vec![]);\n\n    assert_eq!(cert.verify(SystemTime::now(), \u0026ca_pool).unwrap(), CertificateValidity::Ok);\n\n    // Exact matches\n    let (cert, _, _) = test_cert(\u0026ca, \u0026ca_key, round_systime_to_secs(SystemTime::now()).unwrap(), round_systime_to_secs(SystemTime::now() + Duration::from_secs(60 * 60 * 5)).unwrap(), vec![],vec![ca_ip_1, ca_ip_2], vec![]);\n    assert_eq!(cert.verify(SystemTime::now(), \u0026ca_pool).unwrap(), CertificateValidity::Ok);\n\n    // Exact matches reversed\n    let (cert, _, _) = test_cert(\u0026ca, \u0026ca_key, round_systime_to_secs(SystemTime::now()).unwrap(), round_systime_to_secs(SystemTime::now() + Duration::from_secs(60 * 60 * 5)).unwrap(), vec![], vec![ca_ip_2, ca_ip_1], vec![]);\n    assert_eq!(cert.verify(SystemTime::now(), \u0026ca_pool).unwrap(), CertificateValidity::Ok);\n\n    // Exact matches reversed with just one\n    let (cert, _, _) = test_cert(\u0026ca, \u0026ca_key, round_systime_to_secs(SystemTime::now()).unwrap(), round_systime_to_secs(SystemTime::now() + Duration::from_secs(60 * 60 * 5)).unwrap(), vec![], vec![ca_ip_2], vec![]);\n    assert_eq!(cert.verify(SystemTime::now(), \u0026ca_pool).unwrap(), CertificateValidity::Ok);\n}\n\n#[test]\nfn cert_private_key() {\n    let (ca, ca_key, _) = test_ca_cert(SystemTime::now(), SystemTime::now(), vec![], vec![], vec![]);\n    ca.verify_private_key(\u0026ca_key.to_keypair_bytes()).unwrap();\n\n    let (_, ca_key2, _) = test_ca_cert(SystemTime::now(), SystemTime::now(), vec![], vec![], vec![]);\n    ca.verify_private_key(\u0026ca_key2.to_keypair_bytes()).unwrap_err();\n\n    let (cert, priv_key, _) = test_cert(\u0026ca, \u0026ca_key, SystemTime::now(), SystemTime::now(), vec![], vec![], vec![]);\n    cert.verify_private_key(\u0026priv_key.to_bytes()).unwrap();\n\n    let (cert2, _, _) = test_cert(\u0026ca, \u0026ca_key, SystemTime::now(), SystemTime::now(), vec![], vec![], vec![]);\n    cert2.verify_private_key(\u0026priv_key.to_bytes()).unwrap_err();\n}\n\n#[macro_export]\nmacro_rules! netmask {\n    ($ip:expr,$mask:expr) =\u003e {\n        Ipv4Net::with_netmask(Ipv4Addr::from_str($ip).unwrap(), Ipv4Addr::from_str($mask).unwrap()).unwrap()\n    };\n}\n\nfn round_systime_to_secs(time: SystemTime) -\u003e Result\u003cSystemTime, SystemTimeError\u003e {\n    let secs = time.duration_since(UNIX_EPOCH)?.as_secs();\n    Ok(SystemTime::UNIX_EPOCH.add(Duration::from_secs(secs)))\n}\n\nfn test_ca_cert(before: SystemTime, after: SystemTime, ips: Vec\u003cIpv4Net\u003e, subnets: Vec\u003cIpv4Net\u003e, groups: Vec\u003cString\u003e) -\u003e (NebulaCertificate, SigningKey, VerifyingKey) {\n    let mut csprng = OsRng;\n    let key = SigningKey::generate(\u0026mut csprng);\n    let pub_key = key.verifying_key();\n\n    let mut cert = NebulaCertificate {\n        details: NebulaCertificateDetails {\n            name: \"TEST_CA\".to_string(),\n            ips,\n            subnets,\n            groups,\n            not_before: before,\n            not_after: after,\n            public_key: pub_key.to_bytes(),\n            is_ca: true,\n            issuer: \"\".to_string(),\n        },\n        signature: vec![],\n    };\n    cert.sign(\u0026key).unwrap();\n    (cert, key, pub_key)\n}\n\nfn test_cert(ca: \u0026NebulaCertificate, key: \u0026SigningKey, before: SystemTime, after: SystemTime, ips: Vec\u003cIpv4Net\u003e, subnets: Vec\u003cIpv4Net\u003e, groups: Vec\u003cString\u003e) -\u003e (NebulaCertificate, SigningKey, VerifyingKey) {\n    let issuer = ca.sha256sum().unwrap();\n\n    let real_groups = if groups.is_empty() {\n        vec![\"test-group1\".to_string(), \"test-group2\".to_string(), \"test-group3\".to_string()]\n    } else {\n        groups\n    };\n\n    let real_ips = if ips.is_empty() {\n        vec![\n            netmask!(\"10.1.1.1\", \"255.255.255.0\"),\n            netmask!(\"10.1.1.2\", \"255.255.0.0\"),\n            netmask!(\"10.1.1.3\", \"255.0.0.0\")\n        ]\n    } else {\n        ips\n    };\n\n    let real_subnets = if subnets.is_empty() {\n        vec![\n            netmask!(\"9.1.1.1\", \"255.255.255.128\"),\n            netmask!(\"9.1.1.2\", \"255.255.255.0\"),\n            netmask!(\"9.1.1.3\", \"255.255.0.0\")\n        ]\n    } else {\n        subnets\n    };\n\n    let mut csprng = OsRng;\n    let cert_key = SigningKey::generate(\u0026mut csprng);\n    let pub_key = cert_key.verifying_key();\n\n    let mut cert = NebulaCertificate {\n        details: NebulaCertificateDetails {\n            name: \"TEST_CA\".to_string(),\n            ips: real_ips,\n            subnets: real_subnets,\n            groups: real_groups,\n            not_before: before,\n            not_after: after,\n            public_key: pub_key.to_bytes(),\n            is_ca: false,\n            issuer,\n        },\n        signature: vec![],\n    };\n    cert.sign(key).unwrap();\n    (cert, cert_key, pub_key)\n}\n\n#[allow(dead_code)]\nfn in_a_minute() -\u003e SystemTime {\n    round_systime_to_secs(SystemTime::now().add(Duration::from_secs(60))).unwrap()\n}\n#[allow(dead_code)]\nfn a_minute_ago() -\u003e SystemTime {\n    round_systime_to_secs(SystemTime::now().sub(Duration::from_secs(60))).unwrap()\n}","traces":[],"covered":0,"coverable":0}]};
+        var data = {"files":[{"path":["/","home","core","prj","e3t","trifid","tfclient","src","main.rs"],"content":"fn main() {\n    println!(\"Hello, world!\");\n}\n","traces":[],"covered":0,"coverable":0},{"path":["/","home","core","prj","e3t","trifid","trifid-api","build.rs"],"content":"// generated by `sqlx migrate build-script`\nfn main() {\n    // trigger recompilation when a new migration is added\n    println!(\"cargo:rerun-if-changed=migrations\");\n}","traces":[],"covered":0,"coverable":0},{"path":["/","home","core","prj","e3t","trifid","trifid-api","src","auth.rs"],"content":"use rocket::http::Status;\nuse rocket::{Request};\nuse rocket::request::{FromRequest, Outcome};\nuse crate::tokens::{validate_auth_token, validate_session_token};\n\npub struct PartialUserInfo {\n    pub user_id: i32,\n    pub created_at: i64,\n    pub email: String,\n    pub has_totp_auth: bool,\n\n    pub session_id: String,\n    pub auth_id: Option\u003cString\u003e\n}\n\n#[derive(Debug)]\npub enum AuthenticationError {\n    MissingToken,\n    InvalidToken(usize),\n    DatabaseError,\n    RequiresTOTP\n}\n\n#[rocket::async_trait]\nimpl\u003c'r\u003e FromRequest\u003c'r\u003e for PartialUserInfo {\n    type Error = AuthenticationError;\n\n    async fn from_request(req: \u0026'r Request\u003c'_\u003e) -\u003e Outcome\u003cSelf, Self::Error\u003e {\n        let headers = req.headers();\n\n        // make sure the bearer token exists\n        if let Some(authorization) = headers.get_one(\"Authorization\") {\n            // parse bearer token\n            let components = authorization.split(' ').collect::\u003cVec\u003c\u0026str\u003e\u003e();\n\n            if components.len() != 2 \u0026\u0026 components.len() != 3 {\n                return Outcome::Failure((Status::Unauthorized, AuthenticationError::MissingToken));\n            }\n\n            if components[0] != \"Bearer\" {\n                return Outcome::Failure((Status::Unauthorized, AuthenticationError::InvalidToken(0)));\n            }\n\n            if components.len() == 2 \u0026\u0026 !components[1].starts_with(\"st-\") {\n                return Outcome::Failure((Status::Unauthorized, AuthenticationError::InvalidToken(1)));\n            }\n\n            let st: String;\n            let user_id: i64;\n            let at: Option\u003cString\u003e;\n\n            match \u0026components[1][..3] {\n                \"st-\" =\u003e {\n                    // validate session token\n                    st = components[1].to_string();\n                    match validate_session_token(st.clone(), req.rocket().state().unwrap()).await {\n                        Ok(uid) =\u003e user_id = uid,\n                        Err(_) =\u003e return Outcome::Failure((Status::Unauthorized, AuthenticationError::InvalidToken(2)))\n                    }\n                },\n                _ =\u003e return Outcome::Failure((Status::Unauthorized, AuthenticationError::InvalidToken(3)))\n            }\n\n            if components.len() == 3 {\n                match \u0026components[2][..3] {\n                    \"at-\" =\u003e {\n                        // validate auth token\n                        at = Some(components[2].to_string());\n                        match validate_auth_token(at.clone().unwrap().clone(), st.clone(), req.rocket().state().unwrap()).await {\n                            Ok(_) =\u003e (),\n                            Err(_) =\u003e return Outcome::Failure((Status::Unauthorized, AuthenticationError::InvalidToken(4)))\n                        }\n                    },\n                    _ =\u003e return Outcome::Failure((Status::Unauthorized, AuthenticationError::InvalidToken(5)))\n                }\n            } else {\n                at = None;\n            }\n\n            // this user is 100% valid and authenticated, fetch their info\n\n            let user = match sqlx::query!(\"SELECT * FROM users WHERE id = $1\", user_id.clone() as i32).fetch_one(req.rocket().state().unwrap()).await {\n                Ok(u) =\u003e u,\n                Err(_) =\u003e return Outcome::Failure((Status::InternalServerError, AuthenticationError::DatabaseError))\n            };\n\n            Outcome::Success(PartialUserInfo {\n                user_id: user_id as i32,\n                created_at: user.created_on as i64,\n                email: user.email,\n                has_totp_auth: at.is_some(),\n                session_id: st,\n                auth_id: at,\n            })\n        } else {\n            Outcome::Failure((Status::Unauthorized, AuthenticationError::MissingToken))\n        }\n    }\n}\n\npub struct TOTPAuthenticatedUserInfo {\n    pub user_id: i32,\n    pub created_at: i64,\n    pub email: String,\n}\n#[rocket::async_trait]\nimpl\u003c'r\u003e FromRequest\u003c'r\u003e for TOTPAuthenticatedUserInfo {\n    type Error = AuthenticationError;\n\n    async fn from_request(request: \u0026'r Request\u003c'_\u003e) -\u003e Outcome\u003cSelf, Self::Error\u003e {\n        let userinfo = PartialUserInfo::from_request(request).await;\n        match userinfo {\n            Outcome::Failure(e) =\u003e Outcome::Failure(e),\n            Outcome::Forward(f) =\u003e Outcome::Forward(f),\n            Outcome::Success(s) =\u003e {\n                if s.has_totp_auth {\n                    Outcome::Success(Self {\n                        user_id: s.user_id,\n                        created_at: s.created_at,\n                        email: s.email,\n                    })\n                } else {\n                    Outcome::Failure((Status::Unauthorized, AuthenticationError::RequiresTOTP))\n                }\n            }\n        }\n    }\n}","traces":[{"line":28,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":29,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":32,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":34,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":36,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":37,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":40,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":41,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":44,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":45,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":48,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":49,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":50,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":52,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":53,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":55,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":56,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":57,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":58,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":61,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":64,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":65,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":66,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":68,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":69,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":70,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":71,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":74,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":77,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":82,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":83,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":84,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":87,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":88,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":89,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":90,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":91,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":92,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":93,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":96,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":110,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":111,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":112,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":113,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":114,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":115,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":116,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":117,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":118,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":119,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":120,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":123,"address":[],"length":0,"stats":{"Line":0},"fn_name":null}],"covered":0,"coverable":52},{"path":["/","home","core","prj","e3t","trifid","trifid-api","src","config.rs"],"content":"use serde::Deserialize;\nuse url::Url;\n\n#[derive(Deserialize)]\npub struct TFConfig {\n    pub listen_port: u16,\n    pub db_url: String,\n    pub base: Url,\n    pub web_root: Url,\n    pub magic_links_valid_for: i64,\n    pub session_tokens_valid_for: i64,\n    pub totp_verification_valid_for: i64,\n    pub data_key: String\n}","traces":[],"covered":0,"coverable":0},{"path":["/","home","core","prj","e3t","trifid","trifid-api","src","crypto.rs"],"content":"use std::error::Error;\nuse aes_gcm::{Aes256Gcm, KeyInit, Nonce};\nuse aes_gcm::aead::{Aead, Payload};\nuse crate::config::TFConfig;\n\npub fn get_cipher_from_config(config: \u0026TFConfig) -\u003e Result\u003cAes256Gcm, Box\u003cdyn Error\u003e\u003e {\n    let key_slice = hex::decode(\u0026config.data_key)?;\n    Ok(Aes256Gcm::new_from_slice(\u0026key_slice)?)\n}\n\npub fn encrypt_with_nonce(plaintext: \u0026[u8], nonce: [u8; 12], cipher: \u0026Aes256Gcm) -\u003e Result\u003cVec\u003cu8\u003e, aes_gcm::Error\u003e {\n    let nonce = Nonce::from_slice(\u0026nonce);\n    let ciphertext = cipher.encrypt(nonce, plaintext)?;\n    Ok(ciphertext)\n}\n\npub fn decrypt_with_nonce(ciphertext: \u0026[u8], nonce: [u8; 12], cipher: \u0026Aes256Gcm) -\u003e Result\u003cVec\u003cu8\u003e, aes_gcm::Error\u003e {\n    let nonce = Nonce::from_slice(\u0026nonce);\n    let plaintext = cipher.decrypt(nonce, Payload::from(ciphertext))?;\n    Ok(plaintext)\n}","traces":[],"covered":0,"coverable":0},{"path":["/","home","core","prj","e3t","trifid","trifid-api","src","db.rs"],"content":"","traces":[],"covered":0,"coverable":0},{"path":["/","home","core","prj","e3t","trifid","trifid-api","src","format.rs"],"content":"use std::fmt::{Display, Formatter};\nuse crate::format::PEMValidationError::{IncorrectSegmentLength, InvalidBase64Data, MissingStartSentinel};\nuse crate::util::base64decode;\n\npub const ED_PUBKEY_START_STR: \u0026str = \"-----BEGIN NEBULA ED25519 PUBLIC KEY-----\";\npub const ED_PUBKEY_END_STR: \u0026str = \"-----END NEBULA ED25519 PUBLIC KEY-----\";\n\npub const DH_PUBKEY_START_STR: \u0026str = \"-----BEGIN NEBULA X25519 PUBLIC KEY-----\";\npub const DH_PUBKEY_END_STR: \u0026str = \"-----END NEBULA X25519 PUBLIC KEY-----\";\n\npub enum PEMValidationError {\n    MissingStartSentinel,\n    InvalidBase64Data,\n    MissingEndSentinel,\n    IncorrectSegmentLength(usize, usize)\n}\nimpl Display for PEMValidationError {\n    fn fmt(\u0026self, f: \u0026mut Formatter\u003c'_\u003e) -\u003e std::fmt::Result {\n        match self {\n            Self::MissingEndSentinel =\u003e write!(f, \"Missing ending sentinel\"),\n            Self::MissingStartSentinel =\u003e write!(f, \"Missing starting sentinel\"),\n            Self::InvalidBase64Data =\u003e write!(f, \"invalid base64 data\"),\n            Self::IncorrectSegmentLength(expected, got) =\u003e write!(f, \"incorrect number of segments, expected {} got {}\", expected, got)\n        }\n    }\n}\n\npub fn validate_ed_pubkey_pem(pubkey: \u0026str) -\u003e Result\u003c(), PEMValidationError\u003e {\n    let segments = pubkey.split('\\n');\n    let segs = segments.collect::\u003cVec\u003c\u0026str\u003e\u003e();\n    if segs.len() \u003c 3 {\n        return Err(IncorrectSegmentLength(3, segs.len()))\n    }\n    if segs[0] != ED_PUBKEY_START_STR {\n        return Err(MissingStartSentinel)\n    }\n    if base64decode(segs[1]).is_err() {\n        return Err(InvalidBase64Data)\n    }\n    if segs[2] != ED_PUBKEY_END_STR {\n        return Err(MissingStartSentinel)\n    }\n    Ok(())\n}\n\npub fn validate_dh_pubkey_pem(pubkey: \u0026str) -\u003e Result\u003c(), PEMValidationError\u003e {\n    let segments = pubkey.split('\\n');\n    let segs = segments.collect::\u003cVec\u003c\u0026str\u003e\u003e();\n    if segs.len() \u003c 3 {\n        return Err(IncorrectSegmentLength(3, segs.len()))\n    }\n    if segs[0] != DH_PUBKEY_START_STR {\n        return Err(MissingStartSentinel)\n    }\n    if base64decode(segs[1]).is_err() {\n        return Err(InvalidBase64Data)\n    }\n    if segs[2] != DH_PUBKEY_END_STR {\n        return Err(MissingStartSentinel)\n    }\n    Ok(())\n}\n\npub fn validate_ed_pubkey_base64(pubkey: \u0026str) -\u003e Result\u003c(), PEMValidationError\u003e {\n    match base64decode(pubkey) {\n        Ok(k) =\u003e validate_ed_pubkey_pem(match std::str::from_utf8(k.as_ref()) {\n            Ok(k) =\u003e k,\n            Err(_) =\u003e return Err(InvalidBase64Data)\n        }),\n        Err(_) =\u003e Err(InvalidBase64Data)\n    }\n}\n\npub fn validate_dh_pubkey_base64(pubkey: \u0026str) -\u003e Result\u003c(), PEMValidationError\u003e {\n    match base64decode(pubkey) {\n        Ok(k) =\u003e validate_dh_pubkey_pem(match std::str::from_utf8(k.as_ref()) {\n            Ok(k) =\u003e k,\n            Err(_) =\u003e return Err(InvalidBase64Data)\n        }),\n        Err(_) =\u003e Err(InvalidBase64Data)\n    }\n}","traces":[],"covered":0,"coverable":0},{"path":["/","home","core","prj","e3t","trifid","trifid-api","src","main.rs"],"content":"extern crate core;\n\nuse std::error::Error;\nuse std::fs;\nuse std::path::Path;\nuse dotenvy::dotenv;\nuse log::{error, info};\nuse rocket::{catchers, Request, Response, routes};\nuse rocket::fairing::{Fairing, Info, Kind};\nuse rocket::http::Header;\nuse sqlx::migrate::Migrator;\nuse sqlx::postgres::PgPoolOptions;\nuse crate::config::TFConfig;\n\npub mod format;\npub mod util;\npub mod db;\npub mod config;\npub mod tokens;\npub mod routes;\npub mod auth;\npub mod crypto;\npub mod org;\n\nstatic MIGRATOR: Migrator = sqlx::migrate!();\n\npub struct CORS;\n\n#[rocket::async_trait]\nimpl Fairing for CORS {\n    fn info(\u0026self) -\u003e Info {\n        Info {\n            name: \"Add CORS headers to responses\",\n            kind: Kind::Response\n        }\n    }\n\n    async fn on_response\u003c'r\u003e(\u0026self, _request: \u0026'r Request\u003c'_\u003e, response: \u0026mut Response\u003c'r\u003e) {\n        response.set_header(Header::new(\"Access-Control-Allow-Origin\", \"*\"));\n        response.set_header(Header::new(\"Access-Control-Allow-Methods\", \"POST, GET, PATCH, OPTIONS\"));\n        response.set_header(Header::new(\"Access-Control-Allow-Headers\", \"*\"));\n        response.set_header(Header::new(\"Access-Control-Allow-Credentials\", \"true\"));\n    }\n}\n\n#[rocket::main]\nasync fn main() -\u003e Result\u003c(), Box\u003cdyn Error\u003e\u003e {\n    let _ = rocket::build();\n\n    info!(\"[tfapi] loading config\");\n\n    let _ = dotenv();\n\n    if std::env::var(\"CONFIG_FILE\").is_err() \u0026\u0026 !Path::new(\"config.toml\").exists() {\n        error!(\"[tfapi] fatal: the environment variable CONFIG_FILE is not set\");\n        error!(\"[tfapi]  help: try creating a .env file that sets it\");\n        error!(\"[tfapi]  help: or, create a file config.toml with your config, as it is loaded automatically\");\n        std::process::exit(1);\n    }\n\n    let config_file = if Path::new(\"config.toml\").exists() {\n        \"config.toml\".to_string()\n    } else {\n        std::env::var(\"CONFIG_FILE\").unwrap()\n    };\n\n    let config_data = match fs::read_to_string(\u0026config_file) {\n        Ok(d) =\u003e d,\n        Err(e) =\u003e {\n            error!(\"[tfapi] fatal: unable to read config from {}\", config_file);\n            error!(\"[tfapi] fatal: {}\", e);\n            std::process::exit(1);\n        }\n    };\n\n    let config: TFConfig = match toml::from_str(\u0026config_data) {\n        Ok(c) =\u003e c,\n        Err(e) =\u003e {\n            error!(\"[tfapi] fatal: unable to parse config from {}\", config_file);\n            error!(\"[tfapi] fatal: {}\", e);\n            std::process::exit(1);\n        }\n    };\n\n    info!(\"[tfapi] connecting to database pool\");\n\n    let pool = match PgPoolOptions::new().max_connections(5).connect(\u0026config.db_url).await {\n        Ok(p) =\u003e p,\n        Err(e) =\u003e {\n            error!(\"[tfapi] fatal: unable to connect to database pool\");\n            error!(\"[tfapi] fatal: {}\", e);\n            std::process::exit(1);\n        }\n    };\n\n    info!(\"[tfapi] running database migrations\");\n\n    MIGRATOR.run(\u0026pool).await?;\n\n    info!(\"[tfapi] building rocket config\");\n\n    let figment = rocket::Config::figment().merge((\"port\", config.listen_port));\n\n    let _ = rocket::custom(figment)\n        .mount(\"/\", routes![\n            crate::routes::v1::auth::magic_link::magiclink_request,\n            crate::routes::v1::auth::magic_link::options,\n            crate::routes::v1::signup::signup_request,\n            crate::routes::v1::signup::options,\n            crate::routes::v1::auth::verify_magic_link::verify_magic_link,\n            crate::routes::v1::auth::verify_magic_link::options,\n            crate::routes::v1::totp_authenticators::totp_authenticators_request,\n            crate::routes::v1::totp_authenticators::options,\n            crate::routes::v1::verify_totp_authenticator::verify_totp_authenticator_request,\n            crate::routes::v1::verify_totp_authenticator::options,\n            crate::routes::v1::auth::totp::totp_request,\n            crate::routes::v1::auth::totp::options,\n            crate::routes::v1::auth::check_session::check_session,\n            crate::routes::v1::auth::check_session::check_session_auth,\n            crate::routes::v1::auth::check_session::options,\n            crate::routes::v1::auth::check_session::options_auth,\n            crate::routes::v2::whoami::whoami_request,\n            crate::routes::v2::whoami::options,\n\n            crate::routes::v1::organization::options,\n            crate::routes::v1::organization::orgidoptions,\n            crate::routes::v1::organization::orginfo_req,\n            crate::routes::v1::organization::orglist_req,\n            crate::routes::v1::organization::create_org\n        ])\n        .register(\"/\", catchers![\n            crate::routes::handler_400,\n            crate::routes::handler_401,\n            crate::routes::handler_403,\n            crate::routes::handler_404,\n            crate::routes::handler_422,\n\n            crate::routes::handler_500,\n            crate::routes::handler_501,\n            crate::routes::handler_502,\n            crate::routes::handler_503,\n            crate::routes::handler_504,\n            crate::routes::handler_505,\n        ])\n        .attach(CORS)\n        .manage(pool)\n        .manage(config)\n        .launch().await?;\n\n    Ok(())\n}","traces":[{"line":38,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":39,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":40,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":41,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":42,"address":[],"length":0,"stats":{"Line":0},"fn_name":null}],"covered":0,"coverable":5},{"path":["/","home","core","prj","e3t","trifid","trifid-api","src","org.rs"],"content":"use std::error::Error;\nuse rocket::form::validate::Contains;\nuse sqlx::PgPool;\n\npub async fn get_org_by_owner_id(user: i32, db: \u0026PgPool) -\u003e Result\u003cOption\u003ci32\u003e, Box\u003cdyn Error\u003e\u003e {\n    Ok(match sqlx::query!(\"SELECT id FROM organizations WHERE owner = $1\", user).fetch_optional(db).await? {\n        Some(r) =\u003e Some(r.id),\n        None =\u003e None\n    })\n}\n\npub async fn get_orgs_by_assoc_id(user: i32, db: \u0026PgPool) -\u003e Result\u003cVec\u003ci32\u003e, Box\u003cdyn Error\u003e\u003e {\n    let res: Vec\u003c_\u003e = sqlx::query!(\"SELECT org_id FROM organization_authorized_users WHERE user_id = $1\", user).fetch_all(db).await?;\n\n    let mut ret = vec![];\n\n    for i in res {\n        ret.push(i.org_id);\n    }\n\n    Ok(ret)\n}\n\npub async fn get_users_by_assoc_org(org: i32, db: \u0026PgPool) -\u003e Result\u003cVec\u003ci32\u003e, Box\u003cdyn Error\u003e\u003e {\n    let res: Vec\u003c_\u003e = sqlx::query!(\"SELECT user_id FROM organization_authorized_users WHERE org_id = $1\", org).fetch_all(db).await?;\n\n    let mut ret = vec![];\n\n    for i in res {\n        ret.push(i.org_id);\n    }\n\n    Ok(ret)\n}\n\npub async fn get_associated_orgs(user: i32, db: \u0026PgPool) -\u003e Result\u003cVec\u003ci32\u003e, Box\u003cdyn Error\u003e\u003e {\n    let mut assoc_orgs = vec![];\n\n    if let Some(owned_org) = get_org_by_owner_id(user, db).await? {\n        assoc_orgs.push(owned_org);\n    }\n\n    assoc_orgs.append(\u0026mut get_orgs_by_assoc_id(user, db).await?);\n\n    Ok(assoc_orgs)\n}\n\npub async fn user_has_org_assoc(user: i32, org: i32, db: \u0026PgPool) -\u003e Result\u003cbool, Box\u003cdyn Error\u003e\u003e {\n    Ok(get_associated_orgs(user, db).await?.contains(org))\n}","traces":[],"covered":0,"coverable":0},{"path":["/","home","core","prj","e3t","trifid","trifid-api","src","routes","mod.rs"],"content":"pub mod v1;\npub mod v2;\n\nuse rocket::catch;\nuse serde::{Serialize};\nuse rocket::http::Status;\n\npub const ERR_MSG_MALFORMED_REQUEST: \u0026str = \"unable to parse the request body - is it valid JSON, using correct types?\";\npub const ERR_MSG_MALFORMED_REQUEST_CODE: \u0026str = \"ERR_MALFORMED_REQUEST\";\n\n/*\nTODO:\n    /v1/auth/magic-link                         [done]\n    /v1/auth/totp                               [done]\n    /v1/auth/verify-magic-link                  [done]\n    /v1/hosts/host-{id}/enrollment-code\n    /v1/hosts/host-{id}/enrollment-code-check\n    /v1/hosts/host-{id}\n    /v1/roles/role-{id}\n    /v1/feature-flags\n    /v1/hosts\n    /v1/networks\n    /v1/roles\n    /v1/signup                                  [done]\n    /v1/totp-authenticators                     [done]\n    /v1/verify-totp-authenticator               [done]\n    /v1/dnclient\n    /v2/enroll\n    /v2/whoami                                  [in-progress]\n */\n\n#[derive(Serialize)]\n#[serde(crate = \"rocket::serde\")]\npub struct APIError {\n    errors: Vec\u003cAPIErrorSingular\u003e\n}\n#[derive(Serialize)]\n#[serde(crate = \"rocket::serde\")]\npub struct APIErrorSingular {\n    code: String,\n    message: String\n}\n\nmacro_rules! error_handler {\n    ($code: expr, $err: expr, $msg: expr) =\u003e {\n        ::paste::paste! {\n            #[catch($code)]\n            pub fn [\u003chandler_ $code\u003e]() -\u003e (Status, String) {\n                (Status::from_code($code).unwrap(), format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{}\\\"}}]}}\", $err, $msg))\n            }\n        }\n    };\n}\nerror_handler!(400, \"ERR_MALFORMED_REQUEST\", \"unable to parse the request body, is it properly formatted?\");\nerror_handler!(401, \"ERR_AUTHENTICATION_REQUIRED\", \"this endpoint requires authentication but it was not provided\");\nerror_handler!(403, \"ERR_UNAUTHORIZED\", \"authorization was provided but it is expired or invalid\");\nerror_handler!(404, \"ERR_NOT_FOUND\", \"resource not found\");\nerror_handler!(405, \"ERR_METHOD_NOT_ALLOWED\", \"method not allowed for this endpoint\");\nerror_handler!(422, \"ERR_MALFORMED_REQUEST\", \"unable to parse the request body, is it properly formatted?\");\n\nerror_handler!(500, \"ERR_QL_QUERY_FAILED\", \"graphql query timed out\");\nerror_handler!(501, \"ERR_NOT_IMPLEMENTED\", \"query not supported by this version of graphql\");\nerror_handler!(502, \"ERR_PROXY_ERR\", \"servers under load, please try again later\");\nerror_handler!(503, \"ERR_SERVER_OVERLOADED\", \"servers under load, please try again later\");\nerror_handler!(504, \"ERR_PROXY_TIMEOUT\", \"servers under load, please try again later\");\nerror_handler!(505, \"ERR_CLIENT_UNSUPPORTED\", \"your version of dnclient is out of date, please update\");\n","traces":[],"covered":0,"coverable":0},{"path":["/","home","core","prj","e3t","trifid","trifid-api","src","routes","v1","auth","check_session.rs"],"content":"use rocket::{post, options};\nuse crate::auth::{PartialUserInfo, TOTPAuthenticatedUserInfo};\n\n#[options(\"/v1/auth/check_session\")]\npub async fn options() -\u003e \u0026'static str {\n    \"\"\n}\n\n#[post(\"/v1/auth/check_session\")]\npub async fn check_session(_user: PartialUserInfo) -\u003e \u0026'static str {\n    \"ok\"\n}\n\n#[options(\"/v1/auth/check_auth\")]\npub async fn options_auth() -\u003e \u0026'static str {\n    \"\"\n}\n\n\n#[post(\"/v1/auth/check_auth\")]\npub async fn check_session_auth(_user: TOTPAuthenticatedUserInfo) -\u003e \u0026'static str {\n    \"ok\"\n}","traces":[],"covered":0,"coverable":0},{"path":["/","home","core","prj","e3t","trifid","trifid-api","src","routes","v1","auth","magic_link.rs"],"content":"use rocket::{post, State};\nuse rocket::serde::json::Json;\nuse serde::{Serialize, Deserialize};\nuse rocket::http::{ContentType, Status};\nuse sqlx::PgPool;\nuse crate::config::TFConfig;\nuse crate::tokens::send_magic_link;\nuse rocket::options;\n\n#[derive(Serialize, Deserialize)]\n#[serde(crate = \"rocket::serde\")]\npub struct MagicLinkRequest {\n    pub email: String,\n}\n\n#[derive(Serialize, Deserialize)]\n#[serde(crate = \"rocket::serde\")]\npub struct MagicLinkResponseMetadata {}\n\n#[derive(Serialize, Deserialize)]\n#[serde(crate = \"rocket::serde\")]\npub struct MagicLinkResponse {\n    pub data: Option\u003cString\u003e,\n    pub metadata: MagicLinkResponseMetadata,\n}\n\n\n#[options(\"/v1/auth/magic-link\")]\npub async fn options() -\u003e \u0026'static str {\n    \"\"\n}\n\n#[post(\"/v1/auth/magic-link\", data = \"\u003creq\u003e\")]\npub async fn magiclink_request(req: Json\u003cMagicLinkRequest\u003e, pool: \u0026State\u003cPgPool\u003e, config: \u0026State\u003cTFConfig\u003e) -\u003e Result\u003c(ContentType, Json\u003cMagicLinkResponse\u003e), (Status, String)\u003e {\n    // figure out if the user already exists\n    let mut id = -1;\n    match sqlx::query!(\"SELECT id FROM users WHERE email = $1\", req.email.clone()).fetch_optional(pool.inner()).await {\n        Ok(res) =\u003e if let Some(r) = res { id = r.id as i64 },\n        Err(e) =\u003e {\n            return Err((Status::InternalServerError, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{} - {}\\\"}}]}}\", \"ERR_QL_QUERY_FAILED\", \"an error occurred while running the graphql query\", e)))\n        }\n    }\n\n    if id == -1 {\n        return Err((Status::Unauthorized, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{}\\\"}}]}}\", \"ERR_UNAUTHORIZED\", \"authorization was provided but it is expired or invalid\")))\n    }\n\n    // send magic link to email\n    match send_magic_link(id, req.email.clone(), pool.inner(), config.inner()).await {\n        Ok(_) =\u003e (),\n        Err(e) =\u003e {\n            return Err((Status::InternalServerError, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{} - {}\\\"}}]}}\", \"ERR_QL_QUERY_FAILED\", \"an error occurred while running the graphql query\", e)))\n        }\n    };\n\n    // this endpoint doesn't actually ever return an error? it will send you the magic link no matter what\n    // this appears to do the exact same thing as /v1/auth/magic-link, but it doesn't check if you have an account (magic-link does)\n    Ok((ContentType::JSON, Json(MagicLinkResponse {\n        data: None,\n        metadata: MagicLinkResponseMetadata {},\n    })))\n}","traces":[],"covered":0,"coverable":0},{"path":["/","home","core","prj","e3t","trifid","trifid-api","src","routes","v1","auth","mod.rs"],"content":"pub mod verify_magic_link;\npub mod magic_link;\npub mod totp;\npub mod check_session;","traces":[],"covered":0,"coverable":0},{"path":["/","home","core","prj","e3t","trifid","trifid-api","src","routes","v1","auth","totp.rs"],"content":"use rocket::http::{ContentType, Status};\nuse rocket::serde::json::Json;\nuse crate::auth::PartialUserInfo;\nuse serde::{Serialize, Deserialize};\nuse rocket::{post, State};\nuse sqlx::PgPool;\nuse rocket::options;\nuse crate::tokens::{generate_auth_token, get_totpmachine, user_has_totp};\n\npub const TOTP_GENERIC_UNAUTHORIZED_ERROR: \u0026str = \"{\\\"errors\\\":[{\\\"code\\\":\\\"ERR_INVALID_TOTP_CODE\\\",\\\"message\\\":\\\"invalid TOTP code (maybe it expired?)\\\",\\\"path\\\":\\\"code\\\"}]}\";\npub const TOTP_NO_TOTP_ERROR: \u0026str = \"{\\\"errors\\\":[{\\\"code\\\":\\\"ERR_NO_TOTP\\\",\\\"message\\\":\\\"logged-in user does not have totp enabled\\\",\\\"path\\\":\\\"code\\\"}]}\";\n\n#[derive(Serialize, Deserialize)]\n#[serde(crate = \"rocket::serde\")]\npub struct TotpRequest {\n    pub code: String\n}\n\n#[derive(Serialize, Deserialize)]\n#[serde(crate = \"rocket::serde\")]\npub struct TotpResponseData {\n    #[serde(rename = \"authToken\")]\n    auth_token: String\n}\n#[derive(Serialize, Deserialize)]\n#[serde(crate = \"rocket::serde\")]\npub struct TotpResponseMetadata {\n}\n#[derive(Serialize, Deserialize)]\n#[serde(crate = \"rocket::serde\")]\npub struct TotpResponse {\n    data: TotpResponseData,\n    metadata: TotpResponseMetadata\n}\n\n#[options(\"/v1/auth/totp\")]\npub async fn options() -\u003e \u0026'static str {\n    \"\"\n}\n\n\n#[post(\"/v1/auth/totp\", data = \"\u003creq\u003e\")]\npub async fn totp_request(req: Json\u003cTotpRequest\u003e, user: PartialUserInfo, db: \u0026State\u003cPgPool\u003e) -\u003e Result\u003c(ContentType, Json\u003cTotpResponse\u003e), (Status, String)\u003e {\n    if !match user_has_totp(user.user_id, db.inner()).await {\n        Ok(b) =\u003e b,\n        Err(e) =\u003e return Err((Status::InternalServerError, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{} - {}\\\"}}]}}\", \"ERR_UNABLE_TO_ISSUE\", \"an error occured trying to issue a session token, please try again later\", e)))\n    } {\n        return Err((Status::UnprocessableEntity, TOTP_NO_TOTP_ERROR.to_string()))\n    }\n\n    if user.has_totp_auth {\n        return Err((Status::BadRequest, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{}\\\"}}]}}\", \"ERR_TOTP_ALREADY_AUTHED\", \"user already has valid totp authentication\")))\n    }\n\n    let totpmachine = match get_totpmachine(user.user_id, db.inner()).await {\n        Ok(t) =\u003e t,\n        Err(e) =\u003e {\n            return Err((Status::InternalServerError, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{} - {}\\\"}}]}}\", \"ERR_UNABLE_TO_ISSUE\", \"an error occured trying to issue a session token, please try again later\", e)))\n        }\n    };\n\n    if !totpmachine.check_current(\u0026req.0.code).unwrap_or(false) {\n        return Err((Status::Unauthorized, TOTP_GENERIC_UNAUTHORIZED_ERROR.to_string()))\n    }\n\n    Ok((ContentType::JSON, Json(TotpResponse {\n        data: TotpResponseData { auth_token: match generate_auth_token(user.user_id as i64, user.session_id, db.inner()).await {\n            Ok(t) =\u003e t,\n            Err(e) =\u003e { return Err((Status::InternalServerError, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{} - {}\\\"}}]}}\", \"ERR_UNABLE_TO_ISSUE\", \"an error occured trying to issue a session token, please try again later\", e))) }\n        } },\n        metadata: TotpResponseMetadata {},\n    })))\n}","traces":[],"covered":0,"coverable":0},{"path":["/","home","core","prj","e3t","trifid","trifid-api","src","routes","v1","auth","verify_magic_link.rs"],"content":"use std::time::{SystemTime, UNIX_EPOCH};\nuse rocket::http::{ContentType, Status};\nuse rocket::serde::json::Json;\nuse serde::{Serialize, Deserialize};\nuse rocket::{post, State};\nuse sqlx::PgPool;\nuse crate::config::TFConfig;\nuse crate::tokens::generate_session_token;\nuse rocket::options;\n\n#[derive(Serialize, Deserialize)]\n#[serde(crate = \"rocket::serde\")]\npub struct VerifyMagicLinkRequest {\n    #[serde(rename = \"magicLinkToken\")]\n    pub magic_link_token: String,\n}\n\n\n#[derive(Serialize, Deserialize)]\npub struct VerifyMagicLinkResponseMetadata {}\n\n#[derive(Serialize, Deserialize)]\npub struct VerifyMagicLinkResponseData {\n    #[serde(rename = \"sessionToken\")]\n    pub session_token: String,\n}\n\n#[derive(Serialize, Deserialize)]\npub struct VerifyMagicLinkResponse {\n    pub data: VerifyMagicLinkResponseData,\n    pub metadata: VerifyMagicLinkResponseMetadata,\n}\n\n#[options(\"/v1/auth/verify-magic-link\")]\npub async fn options() -\u003e \u0026'static str {\n    \"\"\n}\n\n\n#[post(\"/v1/auth/verify-magic-link\", data = \"\u003creq\u003e\")]\npub async fn verify_magic_link(req: Json\u003cVerifyMagicLinkRequest\u003e, db: \u0026State\u003cPgPool\u003e, config: \u0026State\u003cTFConfig\u003e) -\u003e Result\u003c(ContentType, Json\u003cVerifyMagicLinkResponse\u003e), (Status, String)\u003e {\n    // get the current time to check if the token is expired\n    let (user_id, expired_at) = match sqlx::query!(\"SELECT user_id, expires_on FROM magic_links WHERE id = $1\", req.0.magic_link_token).fetch_one(db.inner()).await {\n        Ok(row) =\u003e (row.user_id, row.expires_on),\n        Err(e) =\u003e {\n            return Err((Status::Unauthorized, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{} - {}\\\"}}]}}\", \"ERR_UNAUTHORIZED\", \"this token is invalid\", e)))\n        }\n    };\n    let current_time = SystemTime::now().duration_since(UNIX_EPOCH).unwrap().as_secs() as i32;\n    println!(\"expired on {}, currently {}\", expired_at, current_time);\n    if expired_at \u003c current_time {\n        return Err((Status::Unauthorized, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{}\\\"}}]}}\", \"ERR_UNAUTHORIZED\", \"valid authorization was provided but it is expired\")))\n    }\n\n    // generate session token\n    let token = match generate_session_token(user_id as i64, db.inner(), config.inner()).await {\n        Ok(t) =\u003e t,\n        Err(e) =\u003e {\n            return Err((Status::InternalServerError, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{} - {}\\\"}}]}}\", \"ERR_UNABLE_TO_ISSUE\", \"an error occured trying to issue a session token, please try again later\", e)))\n        }\n    };\n\n    // delete the token\n    match sqlx::query!(\"DELETE FROM magic_links WHERE id = $1\", req.0.magic_link_token).execute(db.inner()).await {\n        Ok(_) =\u003e (),\n        Err(e) =\u003e {\n            return Err((Status::InternalServerError, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{} - {}\\\"}}]}}\", \"ERR_UNABLE_TO_ISSUE\", \"an error occured trying to issue a session token, please try again later\", e)))\n        }\n    }\n\n    Ok((ContentType::JSON, Json(VerifyMagicLinkResponse {\n        data: VerifyMagicLinkResponseData { session_token: token },\n        metadata: VerifyMagicLinkResponseMetadata {},\n    })))\n}","traces":[],"covered":0,"coverable":0},{"path":["/","home","core","prj","e3t","trifid","trifid-api","src","routes","v1","mod.rs"],"content":"pub mod auth;\npub mod signup;\n\npub mod totp_authenticators;\npub mod verify_totp_authenticator;\npub mod organization;","traces":[],"covered":0,"coverable":0},{"path":["/","home","core","prj","e3t","trifid","trifid-api","src","routes","v1","organization.rs"],"content":"use std::slice::from_raw_parts_mut;\nuse rocket::{get, post, options, State};\nuse rocket::http::{ContentType, Status};\nuse rocket::serde::json::Json;\nuse serde::{Serialize, Deserialize};\nuse sqlx::PgPool;\nuse crate::auth::TOTPAuthenticatedUserInfo;\nuse crate::config::TFConfig;\nuse crate::org::{get_associated_orgs, get_org_by_owner_id, get_users_by_assoc_org, user_has_org_assoc};\n\n#[options(\"/v1/orgs\")]\npub fn options() -\u003e \u0026'static str {\n    \"\"\n}\n#[options(\"/v1/org/\u003c_id\u003e\")]\npub fn orgidoptions(_id: i32) -\u003e \u0026'static str {\n    \"\"\n}\n\n#[derive(Serialize, Deserialize)]\n#[serde(crate = \"rocket::serde\")]\npub struct OrglistStruct {\n    pub org_ids: Vec\u003ci32\u003e\n}\n\n\n#[get(\"/v1/orgs\")]\npub async fn orglist_req(user: TOTPAuthenticatedUserInfo, db: \u0026State\u003cPgPool\u003e) -\u003e Result\u003c(ContentType, Json\u003cOrglistStruct\u003e), (Status, String)\u003e {\n    // this endpoint lists the associated organizations this user has access to\n    let associated_orgs = match get_associated_orgs(user.user_id, db.inner()).await {\n        Ok(r) =\u003e r,\n        Err(e) =\u003e return Err((Status::InternalServerError, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{} - {}\\\"}}]}}\", \"ERR_DB_QUERY_FAILED\", \"an error occurred while running the database query\")))\n    };\n\n    Ok((ContentType::JSON, Json(OrglistStruct {\n        org_ids: associated_orgs\n    })))\n}\n\n#[derive(Serialize, Deserialize)]\n#[serde(crate = \"rocket::serde\")]\npub struct OrginfoStruct {\n    pub org_id: i32,\n    pub owner_id: i32,\n    pub ca_crt: String,\n    pub authorized_users: Vec\u003ci32\u003e\n}\n\n#[get(\"/v1/org/\u003corgid\u003e\")]\npub async fn orginfo_req(orgid: i32, user: TOTPAuthenticatedUserInfo, db: \u0026State\u003cPgPool\u003e) -\u003e Result\u003c(ContentType, Json\u003cOrginfoStruct\u003e), (Status, String)\u003e {\n    if !user_has_org_assoc(orgid, user.user_id, db.inner()).await.map_err(|e| (Status::InternalServerError, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{} - {}\\\"}}]}}\", \"ERR_QL_QUERY_FAILED\", \"an error occurred while running the graphql query\", e)))? {\n        return Err((Status::Unauthorized, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{}\\\"}}]}}\", \"ERR_MISSING_ORG_AUTHORIZATION\", \"this user does not have permission to access this org\")));\n    }\n\n    let org = sqlx::query!(\"SELECT id, owner, ca_crt FROM organizations WHERE id = $1\", orgid).fetch_one(orgid).await.map_err(|e| (Status::InternalServerError, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{} - {}\\\"}}]}}\", \"ERR_QL_QUERY_FAILED\", \"an error occurred while running the graphql query\", e)))?;\n    let authorized_users = get_users_by_assoc_org(orgid, db.inner()).await.map_err(|e| (Status::InternalServerError, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{} - {}\\\"}}]}}\", \"ERR_QL_QUERY_FAILED\", \"an error occurred while running the graphql query\", e)))?;\n\n    Ok((ContentType::JSON, Json(\n        OrginfoStruct {\n            org_id: orgid,\n            owner_id: org.owner,\n            ca_crt: org.ca_crt,\n            authorized_users,\n        }\n    )))\n}\n\n#[post(\"/v1/org\")]\npub async fn create_org(user: TOTPAuthenticatedUserInfo, db: \u0026State\u003cPgPool\u003e, config: \u0026State\u003cTFConfig\u003e) -\u003e Result\u003c(ContentType, Json\u003cOrginfoStruct\u003e), (Status, String)\u003e {\n    if get_org_by_owner_id(user.user_id, db.inner()).await.map_err(|e| (Status::InternalServerError, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{} - {}\\\"}}]}}\", \"ERR_QL_QUERY_FAILED\", \"an error occurred while running the graphql query\", e)))?.is_some() {\n        return Err((Status::Conflict, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{}\\\"}}]}}\", \"ERR_USER_OWNS_ORG\", \"a user can only own one organization at a time\")))\n    }\n\n    // we need to generate a keypair and CA certificate for this new org\n\n    Ok((ContentType::JSON, Json(\n        OrginfoStruct {\n            org_id: orgid,\n            owner_id: org.owner,\n            ca_crt: org.ca_crt,\n            authorized_users,\n        }\n    )))\n}","traces":[],"covered":0,"coverable":0},{"path":["/","home","core","prj","e3t","trifid","trifid-api","src","routes","v1","signup.rs"],"content":"use rocket::{post, State};\nuse rocket::serde::json::Json;\nuse serde::{Serialize, Deserialize};\nuse std::time::{SystemTime, UNIX_EPOCH};\nuse rocket::http::{ContentType, Status};\nuse sqlx::PgPool;\nuse crate::config::TFConfig;\nuse crate::tokens::send_magic_link;\nuse rocket::options;\n\n#[derive(Serialize, Deserialize)]\n#[serde(crate = \"rocket::serde\")]\npub struct SignupRequest {\n    pub email: String,\n}\n\n#[derive(Serialize, Deserialize)]\n#[serde(crate = \"rocket::serde\")]\npub struct SignupResponseMetadata {}\n\n#[derive(Serialize, Deserialize)]\n#[serde(crate = \"rocket::serde\")]\npub struct SignupResponse {\n    pub data: Option\u003cString\u003e,\n    pub metadata: SignupResponseMetadata,\n}\n/*\ncreated_on TIMESTAMP NOT NULL,\n\n    banned INTEGER NOT NULL,\n    ban_reason VARCHAR(1024) NOT NULL\n */\n#[options(\"/v1/signup\")]\npub async fn options() -\u003e \u0026'static str {\n    \"\"\n}\n\n#[post(\"/v1/signup\", data = \"\u003creq\u003e\")]\npub async fn signup_request(req: Json\u003cSignupRequest\u003e, pool: \u0026State\u003cPgPool\u003e, config: \u0026State\u003cTFConfig\u003e) -\u003e Result\u003c(ContentType, Json\u003cSignupResponse\u003e), (Status, String)\u003e {\n    // figure out if the user already exists\n    let mut id = -1;\n    match sqlx::query!(\"SELECT id FROM users WHERE email = $1\", req.email.clone()).fetch_optional(pool.inner()).await {\n        Ok(res) =\u003e if let Some(r) = res { id = r.id as i64 },\n        Err(e) =\u003e {\n            return Err((Status::InternalServerError, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{} - {}\\\"}}]}}\", \"ERR_QL_QUERY_FAILED\", \"an error occurred while running the graphql query\", e)))\n        }\n    }\n\n    if id == -1 {\n        let id_res = match sqlx::query!(\"INSERT INTO users (email, created_on, banned, ban_reason, totp_secret, totp_otpurl, totp_verified) VALUES ($1, $2, $3, $4, $5, $6, $7) ON CONFLICT DO NOTHING RETURNING id;\", req.email, SystemTime::now().duration_since(UNIX_EPOCH).unwrap().as_secs() as i64, 0, \"\", \"\", \"\", 0).fetch_one(pool.inner()).await {\n            Ok(row) =\u003e row.id,\n            Err(e) =\u003e {\n                return Err((Status::InternalServerError, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{} - {}\\\"}}]}}\", \"ERR_QL_QUERY_FAILED\", \"an error occurred while running the graphql query\", e)))\n            }\n        };\n        id = id_res as i64;\n    }\n\n    // send magic link to email\n    match send_magic_link(id, req.email.clone(), pool.inner(), config.inner()).await {\n        Ok(_) =\u003e (),\n        Err(e) =\u003e {\n            return Err((Status::InternalServerError, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{} - {}\\\"}}]}}\", \"ERR_QL_QUERY_FAILED\", \"an error occurred while running the graphql query\", e)))\n        }\n    };\n\n    // this endpoint doesn't actually ever return an error? it will send you the magic link no matter what\n    // this appears to do the exact same thing as /v1/auth/magic-link, but it doesn't check if you have an account (magic-link does)\n    Ok((ContentType::JSON, Json(SignupResponse {\n        data: None,\n        metadata: SignupResponseMetadata {},\n    })))\n}","traces":[],"covered":0,"coverable":0},{"path":["/","home","core","prj","e3t","trifid","trifid-api","src","routes","v1","totp_authenticators.rs"],"content":"use rocket::http::{ContentType, Status};\nuse rocket::serde::json::Json;\nuse rocket::{State, post};\nuse sqlx::PgPool;\nuse serde::{Serialize, Deserialize};\nuse crate::auth::PartialUserInfo;\nuse crate::config::TFConfig;\nuse crate::tokens::{create_totp_token, user_has_totp};\nuse rocket::options;\n\n#[derive(Deserialize)]\npub struct TotpAuthenticatorsRequest {}\n#[derive(Serialize, Deserialize)]\n#[serde(crate = \"rocket::serde\")]\npub struct TotpAuthenticatorsResponseMetadata {}\n#[derive(Serialize, Deserialize)]\n#[serde(crate = \"rocket::serde\")]\npub struct TotpAuthenticatorsResponseData {\n    #[serde(rename = \"totpToken\")]\n    pub totp_token: String,\n    pub secret: String,\n    pub url: String,\n}\n#[derive(Serialize, Deserialize)]\n#[serde(crate = \"rocket::serde\")]\npub struct TotpAuthenticatorsResponse {\n    pub data: TotpAuthenticatorsResponseData,\n    pub metadata: TotpAuthenticatorsResponseMetadata,\n}\n\n#[options(\"/v1/totp-authenticators\")]\npub async fn options() -\u003e \u0026'static str {\n    \"\"\n}\n\n\n#[post(\"/v1/totp-authenticators\", data = \"\u003c_req\u003e\")]\npub async fn totp_authenticators_request(_req: Json\u003cTotpAuthenticatorsRequest\u003e, user: PartialUserInfo, db: \u0026State\u003cPgPool\u003e, config: \u0026State\u003cTFConfig\u003e) -\u003e Result\u003c(ContentType, Json\u003cTotpAuthenticatorsResponse\u003e), (Status, String)\u003e {\n    if match user_has_totp(user.user_id, db.inner()).await {\n        Ok(b) =\u003e b,\n        Err(e) =\u003e return Err((Status::InternalServerError, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{} - {}\\\"}}]}}\", \"ERR_UNABLE_TO_ISSUE\", \"an error occured trying to issue a session token, please try again later\", e)))\n    } {\n        return Err((Status::BadRequest, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{}\\\"}}]}}\", \"ERR_TOTP_ALREADY_EXISTS\", \"this user already has a totp authenticator on their account\")))\n    }\n\n    // generate a totp token\n    let (totptoken, totpmachine) = match create_totp_token(user.email, db.inner(), config.inner()).await {\n        Ok(t) =\u003e t,\n        Err(e) =\u003e return Err((Status::InternalServerError, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{} - {}\\\"}}]}}\", \"ERR_UNABLE_TO_ISSUE\", \"an error occured issuing a totp token, try again later\", e)))\n    };\n\n    Ok((ContentType::JSON, Json(TotpAuthenticatorsResponse {\n        data: TotpAuthenticatorsResponseData {\n            totp_token: totptoken,\n            secret: totpmachine.get_secret_base32(),\n            url: totpmachine.get_url(),\n        },\n        metadata: TotpAuthenticatorsResponseMetadata {},\n    })))\n}","traces":[],"covered":0,"coverable":0},{"path":["/","home","core","prj","e3t","trifid","trifid-api","src","routes","v1","verify_totp_authenticator.rs"],"content":"/*\n{\"totpToken\":\"totp-mH9eLzA9Q5WB-sg3Fq8CfkP13eTh3DxF25kVK2VEDOk\",\"code\":\"266242\"}\n{\"errors\":[{\"code\":\"ERR_INVALID_TOTP_TOKEN\",\"message\":\"TOTP token does not exist (maybe it expired?)\",\"path\":\"totpToken\"}]}\n\n\n{\"totpToken\":\"totp-gaUDaxPrrIBc8GEQ6z0vPisT8k0MEP1fgI8FA2ztLMw\",\"code\":\"175543\"}\n{\"data\":{\"authToken\":\"auth-O7mugxdYta-RKtLMqDW4j8XCJ85EfZKKezeZZXBYtFQ\"},\"metadata\":{}}\n*/\n\nuse rocket::http::{ContentType, Status};\nuse crate::auth::PartialUserInfo;\nuse rocket::post;\nuse rocket::serde::json::Json;\nuse rocket::State;\nuse serde::{Serialize, Deserialize};\nuse sqlx::PgPool;\nuse crate::tokens::{generate_auth_token, use_totp_token, verify_totp_token};\nuse rocket::options;\n\n#[derive(Serialize, Deserialize)]\npub struct VerifyTotpAuthenticatorRequest {\n    #[serde(rename = \"totpToken\")]\n    pub totp_token: String,\n    pub code: String,\n}\n\n#[derive(Serialize, Deserialize)]\npub struct VerifyTotpAuthenticatorResponseMetadata {}\n\n#[derive(Serialize, Deserialize)]\npub struct VerifyTotpAuthenticatorResponseData {\n    #[serde(rename = \"authToken\")]\n    pub auth_token: String,\n}\n\n#[derive(Serialize, Deserialize)]\npub struct VerifyTotpAuthenticatorResponse {\n    pub data: VerifyTotpAuthenticatorResponseData,\n    pub metadata: VerifyTotpAuthenticatorResponseMetadata,\n}\n\n#[options(\"/v1/verify-totp-authenticator\")]\npub async fn options() -\u003e \u0026'static str {\n    \"\"\n}\n\n\n#[post(\"/v1/verify-totp-authenticator\", data = \"\u003creq\u003e\")]\npub async fn verify_totp_authenticator_request(req: Json\u003cVerifyTotpAuthenticatorRequest\u003e, db: \u0026State\u003cPgPool\u003e, user: PartialUserInfo) -\u003e Result\u003c(ContentType, Json\u003cVerifyTotpAuthenticatorResponse\u003e), (Status, String)\u003e {\n    let totpmachine = match verify_totp_token(req.0.totp_token.clone(), user.email.clone(), db.inner()).await {\n        Ok(t) =\u003e t,\n        Err(e) =\u003e return Err((Status::Unauthorized, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{} - {}\\\"}}]}}\", \"ERR_UNAUTHORIZED\", \"this token is invalid\", e)))\n    };\n    if !totpmachine.check_current(\u0026req.0.code).unwrap() {\n        return Err((Status::Unauthorized, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{}\\\",\\\"path\\\":\\\"totpToken\\\"}}]}}\", \"ERR_INVALID_TOTP_CODE\", \"Invalid TOTP code\")))\n    }\n    match use_totp_token(req.0.totp_token, user.email, db.inner()).await {\n        Ok(_) =\u003e (),\n        Err(e) =\u003e return Err((Status::InternalServerError, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{} - {}\\\"}}]}}\", \"ERR_UNABLE_TO_ISSUE\", \"an error occured trying to issue a session token, please try again later\", e)))\n    }\n    Ok((ContentType::JSON, Json(VerifyTotpAuthenticatorResponse {\n        data: VerifyTotpAuthenticatorResponseData { auth_token: match generate_auth_token(user.user_id as i64, user.session_id, db.inner()).await {\n            Ok(at) =\u003e at,\n            Err(e) =\u003e return Err((Status::InternalServerError, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{} - {}\\\"}}]}}\", \"ERR_UNABLE_TO_ISSUE\", \"an error occured trying to issue a session token, please try again later\", e)))\n        } },\n        metadata: VerifyTotpAuthenticatorResponseMetadata {},\n    })))\n}","traces":[],"covered":0,"coverable":0},{"path":["/","home","core","prj","e3t","trifid","trifid-api","src","routes","v2","mod.rs"],"content":"pub mod whoami;","traces":[],"covered":0,"coverable":0},{"path":["/","home","core","prj","e3t","trifid","trifid-api","src","routes","v2","whoami.rs"],"content":"use chrono::{NaiveDateTime, Utc};\nuse serde::{Serialize, Deserialize};\nuse rocket::{options, get, State};\nuse rocket::http::{ContentType, Status};\nuse rocket::serde::json::Json;\nuse sqlx::PgPool;\nuse crate::auth::PartialUserInfo;\nuse crate::tokens::user_has_totp;\n\n#[derive(Serialize, Deserialize)]\npub struct WhoamiMetadata {}\n\n#[derive(Serialize, Deserialize)]\npub struct WhoamiActor {\n    pub id: String,\n    #[serde(rename = \"organizationID\")]\n    pub organization_id: String,\n    pub email: String,\n    #[serde(rename = \"createdAt\")]\n    pub created_at: String,\n    #[serde(rename = \"hasTOTPAuthenticator\")]\n    pub has_totpauthenticator: bool,\n}\n\n#[derive(Serialize, Deserialize)]\npub struct WhoamiData {\n    #[serde(rename = \"actorType\")]\n    pub actor_type: String,\n    pub actor: WhoamiActor,\n}\n\n#[derive(Serialize, Deserialize)]\npub struct WhoamiResponse {\n    pub data: WhoamiData,\n    pub metadata: WhoamiMetadata,\n}\n\n#[options(\"/v2/whoami\")]\npub fn options() -\u003e \u0026'static str {\n    \"\"\n}\n\n#[get(\"/v2/whoami\")]\npub async fn whoami_request(user: PartialUserInfo, db: \u0026State\u003cPgPool\u003e) -\u003e Result\u003c(ContentType, Json\u003cWhoamiResponse\u003e), (Status, String)\u003e {\n    Ok((ContentType::JSON, Json(WhoamiResponse {\n        data: WhoamiData {\n            actor_type: \"user\".to_string(),\n            actor: WhoamiActor {\n                id: user.user_id.to_string(),\n                organization_id: \"TEMP_ORG_BECAUSE_THAT_ISNT_IMPLEMENTED_YET\".to_string(),\n                email: user.email,\n                created_at: NaiveDateTime::from_timestamp_opt(user.created_at, 0).unwrap().and_local_timezone(Utc).unwrap().to_rfc3339(),\n                has_totpauthenticator: match user_has_totp(user.user_id, db.inner()).await {\n                    Ok(b) =\u003e b,\n                    Err(e) =\u003e return Err((Status::InternalServerError, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{} - {}\\\"}}]}}\", \"ERR_DBERROR\", \"an error occured trying to verify your user\", e)))\n                },\n            }\n        },\n        metadata: WhoamiMetadata {},\n    })))\n}","traces":[],"covered":0,"coverable":0},{"path":["/","home","core","prj","e3t","trifid","trifid-api","src","tokens.rs"],"content":"use std::error::Error;\nuse log::info;\nuse sqlx::PgPool;\nuse uuid::Uuid;\nuse crate::config::TFConfig;\nuse std::time::SystemTime;\nuse std::time::UNIX_EPOCH;\nuse totp_rs::{Secret, TOTP};\nuse crate::util::{TOTP_ALGORITHM, TOTP_DIGITS, TOTP_ISSUER, TOTP_SKEW, TOTP_STEP};\n\n// https://admin.defined.net/auth/magic-link?email=coredoescode%40gmail.com\u0026token=ml-ckBsgw_5IdK5VYgseBYcoV_v_cQjtdq1re_RhDu_MKg\npub async fn send_magic_link(id: i64, email: String, db: \u0026PgPool, config: \u0026TFConfig) -\u003e Result\u003c(), Box\u003cdyn Error\u003e\u003e {\n    let otp = format!(\"ml-{}\", Uuid::new_v4());\n    let otp_url = config.web_root.join(\u0026format!(\"/auth/magic-link?email={}\u0026token={}\", urlencoding::encode(\u0026email.clone()), otp.clone())).unwrap();\n    sqlx::query!(\"INSERT INTO magic_links (id, user_id, expires_on) VALUES ($1, $2, $3) ON CONFLICT DO NOTHING;\", otp, id as i32, SystemTime::now().duration_since(UNIX_EPOCH).unwrap().as_secs() as i32 + config.magic_links_valid_for as i32).execute(db).await?;\n    // TODO: send email\n    info!(\"sent magic link {} to {}, valid for {} seconds\", otp_url, email.clone(), config.magic_links_valid_for);\n    Ok(())\n}\n\npub async fn generate_session_token(user_id: i64, db: \u0026PgPool, config: \u0026TFConfig) -\u003e Result\u003cString, Box\u003cdyn Error\u003e\u003e {\n    let token = format!(\"st-{}\", Uuid::new_v4());\n    sqlx::query!(\"INSERT INTO session_tokens (id, user_id, expires_on) VALUES ($1, $2, $3) ON CONFLICT DO NOTHING;\", token, user_id as i32, SystemTime::now().duration_since(UNIX_EPOCH).unwrap().as_secs() as i32 + config.session_tokens_valid_for as i32).execute(db).await?;\n    Ok(token)\n}\npub async fn validate_session_token(token: String, db: \u0026PgPool) -\u003e Result\u003ci64, Box\u003cdyn Error\u003e\u003e {\n    Ok(sqlx::query!(\"SELECT user_id FROM session_tokens WHERE id = $1 AND expires_on \u003e $2\", token, SystemTime::now().duration_since(UNIX_EPOCH).unwrap().as_secs() as i32).fetch_one(db).await?.user_id as i64)\n}\n\npub async fn generate_auth_token(user_id: i64, session_id: String, db: \u0026PgPool) -\u003e Result\u003cString, Box\u003cdyn Error\u003e\u003e {\n    let token = format!(\"at-{}\", Uuid::new_v4());\n    sqlx::query!(\"INSERT INTO auth_tokens (id, session_token, user_id) VALUES ($1, $2, $3) ON CONFLICT DO NOTHING;\", token, session_id, user_id as i32).execute(db).await?;\n    Ok(token)\n}\npub async fn validate_auth_token(token: String, session_id: String, db: \u0026PgPool) -\u003e Result\u003c(), Box\u003cdyn Error\u003e\u003e {\n    validate_session_token(session_id.clone(), db).await?;\n    sqlx::query!(\"SELECT * FROM auth_tokens WHERE id = $1 AND session_token = $2\", token, session_id).fetch_one(db).await?;\n    Ok(())\n}\n\n\n/*\nCREATE TABLE totp_create_tokens (\n    id VARCHAR(39) NOT NULL PRIMARY KEY,\n    expires_on INTEGER NOT NULL,\n    totp_otpurl VARCHAR(3000) NOT NULL,\n    totp_secret VARCHAR(128) NOT NULL\n);\n */\n\npub async fn create_totp_token(email: String, db: \u0026PgPool, config: \u0026TFConfig) -\u003e Result\u003c(String, TOTP), Box\u003cdyn Error\u003e\u003e {\n    // create the TOTP parameters\n\n    let secret = Secret::generate_secret();\n    let totpmachine = TOTP::new(TOTP_ALGORITHM, TOTP_DIGITS, TOTP_SKEW, TOTP_STEP, secret.to_bytes().unwrap(), Some(TOTP_ISSUER.to_string()), email).unwrap();\n    let otpurl = totpmachine.get_url();\n    let otpsecret = totpmachine.get_secret_base32();\n\n    let otpid = format!(\"totp-{}\", Uuid::new_v4());\n\n    sqlx::query!(\"INSERT INTO totp_create_tokens (id, expires_on, totp_otpurl, totp_secret) VALUES ($1, $2, $3, $4);\", otpid.clone(), (SystemTime::now().duration_since(UNIX_EPOCH).unwrap().as_secs() as i64 + config.totp_verification_valid_for) as i32, otpurl, otpsecret).execute(db).await?;\n\n    Ok((otpid, totpmachine))\n}\n\npub async fn verify_totp_token(otpid: String, email: String, db: \u0026PgPool) -\u003e Result\u003cTOTP, Box\u003cdyn Error\u003e\u003e {\n    let totprow = sqlx::query!(\"SELECT * FROM totp_create_tokens WHERE id = $1 AND expires_on \u003e $2\", otpid, SystemTime::now().duration_since(UNIX_EPOCH).unwrap().as_secs() as i32).fetch_one(db).await?;\n    let secret = Secret::Encoded(totprow.totp_secret);\n    let totpmachine = TOTP::new(TOTP_ALGORITHM, TOTP_DIGITS, TOTP_SKEW, TOTP_STEP, secret.to_bytes().unwrap(), Some(TOTP_ISSUER.to_string()), email).unwrap();\n\n    if totpmachine.get_url() != totprow.totp_otpurl {\n        return Err(\"OTPURLs do not match (email does not match?)\".into())\n    }\n\n    Ok(totpmachine)\n}\n\npub async fn use_totp_token(otpid: String, email: String, db: \u0026PgPool) -\u003e Result\u003cTOTP, Box\u003cdyn Error\u003e\u003e {\n    let totpmachine = verify_totp_token(otpid.clone(), email.clone(), db).await?;\n    sqlx::query!(\"DELETE FROM totp_create_tokens WHERE id = $1\", otpid).execute(db).await?;\n    sqlx::query!(\"UPDATE users SET totp_otpurl = $1, totp_secret = $2, totp_verified = 1 WHERE email = $3\", totpmachine.get_url(), totpmachine.get_secret_base32(), email).execute(db).await?;\n    Ok(totpmachine)\n}\n\npub async fn get_totpmachine(user: i32, db: \u0026PgPool) -\u003e Result\u003cTOTP, Box\u003cdyn Error\u003e\u003e {\n    let user = sqlx::query!(\"SELECT totp_secret, totp_otpurl, email FROM users WHERE id = $1\", user).fetch_one(db).await?;\n    let secret = Secret::Encoded(user.totp_secret);\n    Ok(TOTP::new(TOTP_ALGORITHM, TOTP_DIGITS, TOTP_SKEW, TOTP_STEP, secret.to_bytes().unwrap(), Some(TOTP_ISSUER.to_string()), user.email).unwrap())\n}\n\npub async fn user_has_totp(user: i32, db: \u0026PgPool) -\u003e Result\u003cbool, Box\u003cdyn Error\u003e\u003e {\n    Ok(sqlx::query!(\"SELECT totp_verified FROM users WHERE id = $1\", user).fetch_one(db).await?.totp_verified == 1)\n}","traces":[],"covered":0,"coverable":0},{"path":["/","home","core","prj","e3t","trifid","trifid-api","src","util.rs"],"content":"use base64::Engine;\nuse totp_rs::Algorithm;\n\npub const TOTP_ALGORITHM: Algorithm = Algorithm::SHA1;\npub const TOTP_DIGITS: usize = 6;\npub const TOTP_SKEW: u8 = 1;\npub const TOTP_STEP: u64 = 30;\npub const TOTP_ISSUER: \u0026str = \"trifidapi\";\n\npub fn base64decode(val: \u0026str) -\u003e Result\u003cVec\u003cu8\u003e, base64::DecodeError\u003e {\n    base64::engine::general_purpose::STANDARD.decode(val)\n}\npub fn base64encode(val: Vec\u003cu8\u003e) -\u003e String {\n    base64::engine::general_purpose::STANDARD.encode(val)\n}","traces":[],"covered":0,"coverable":0},{"path":["/","home","core","prj","e3t","trifid","trifid-pki","src","ca.rs"],"content":"//! Structs to represent a pool of CA's and blacklisted certificates\n\nuse std::collections::HashMap;\nuse std::error::Error;\nuse std::fmt::{Display, Formatter};\nuse std::time::SystemTime;\nuse ed25519_dalek::VerifyingKey;\nuse crate::cert::{deserialize_nebula_certificate_from_pem, NebulaCertificate};\n\n/// A pool of trusted CA certificates, and certificates that should be blocked.\n/// This is equivalent to the `pki` section in a typical Nebula config.yml.\n#[derive(Default)]\npub struct NebulaCAPool {\n    /// The list of CA root certificates that should be trusted.\n    pub cas: HashMap\u003cString, NebulaCertificate\u003e,\n    /// The list of blocklisted certificate fingerprints\n    pub cert_blocklist: Vec\u003cString\u003e,\n    /// True if any of the member CAs certificates are expired. Must be handled.\n    pub expired: bool\n}\n\nimpl NebulaCAPool {\n    /// Create a new, blank CA pool\n    pub fn new() -\u003e Self {\n        Self::default()\n    }\n\n    /// Create a new CA pool from a set of PEM encoded CA certificates.\n    /// If any of the certificates are expired, the pool will **still be returned**, with the expired flag set.\n    /// This must be handled properly.\n    /// # Errors\n    /// This function will return an error if PEM data provided was invalid.\n    pub fn new_from_pem(bytes: \u0026[u8]) -\u003e Result\u003cSelf, Box\u003cdyn Error\u003e\u003e {\n        let pems = pem::parse_many(bytes)?;\n\n        let mut pool = Self::new();\n\n        for cert in pems {\n            match pool.add_ca_certificate(pem::encode(\u0026cert).as_bytes()) {\n                Ok(did_expire) =\u003e if did_expire { pool.expired = true },\n                Err(e) =\u003e return Err(e)\n            }\n        }\n\n        Ok(pool)\n    }\n\n    /// Add a given CA certificate to the CA pool. If the certificate is expired, it will **still be added** - the return value will be `true` instead of `false`\n    /// # Errors\n    /// This function will return an error if the certificate is invalid in any way.\n    pub fn add_ca_certificate(\u0026mut self, bytes: \u0026[u8]) -\u003e Result\u003cbool, Box\u003cdyn Error\u003e\u003e {\n        let cert = deserialize_nebula_certificate_from_pem(bytes)?;\n\n        if !cert.details.is_ca {\n            return Err(CaPoolError::NotACA.into())\n        }\n\n        if !cert.check_signature(\u0026VerifyingKey::from_bytes(\u0026cert.details.public_key)?)? {\n            return Err(CaPoolError::NotSelfSigned.into())\n        }\n\n        let fingerprint = cert.sha256sum()?;\n        let expired = cert.expired(SystemTime::now());\n\n        if expired { self.expired = true }\n\n        self.cas.insert(fingerprint, cert);\n\n       Ok(expired)\n    }\n\n    /// Blocklist the given certificate in the CA pool\n    pub fn blocklist_fingerprint(\u0026mut self, fingerprint: \u0026str) {\n        self.cert_blocklist.push(fingerprint.to_string());\n    }\n\n    /// Clears the list of blocklisted fingerprints\n    pub fn reset_blocklist(\u0026mut self) {\n        self.cert_blocklist = vec![];\n    }\n\n    /// Checks if the given certificate is blocklisted\n    pub fn is_blocklisted(\u0026self, cert: \u0026NebulaCertificate) -\u003e bool {\n        let Ok(h) = cert.sha256sum() else { return false };\n        self.cert_blocklist.contains(\u0026h)\n    }\n\n    /// Gets the CA certificate used to sign the given certificate\n    /// # Errors\n    /// This function will return an error if the certificate does not have an issuer attached (it is self-signed)\n    pub fn get_ca_for_cert(\u0026self, cert: \u0026NebulaCertificate) -\u003e Result\u003cOption\u003c\u0026NebulaCertificate\u003e, Box\u003cdyn Error\u003e\u003e {\n        if cert.details.issuer == String::new() {\n            return Err(CaPoolError::NoIssuer.into())\n        }\n\n        Ok(self.cas.get(\u0026cert.details.issuer))\n    }\n\n    /// Get a list of trusted CA fingerprints\n    pub fn get_fingerprints(\u0026self) -\u003e Vec\u003c\u0026String\u003e {\n        self.cas.keys().collect()\n    }\n}\n\n#[derive(Debug)]\n/// A list of errors that can happen when working with a CA Pool\npub enum CaPoolError {\n    /// Tried to add a non-CA cert to the CA pool\n    NotACA,\n    /// Tried to add a non-self-signed cert to the CA pool (all CAs must be root certificates)\n    NotSelfSigned,\n    /// Tried to look up a certificate that does not have an issuer field\n    NoIssuer\n}\nimpl Error for CaPoolError {}\nimpl Display for CaPoolError {\n    fn fmt(\u0026self, f: \u0026mut Formatter\u003c'_\u003e) -\u003e std::fmt::Result {\n        match self {\n            Self::NotACA =\u003e write!(f, \"Tried to add a non-CA cert to the CA pool\"),\n            Self::NotSelfSigned =\u003e write!(f, \"Tried to add a non-self-signed cert to the CA pool (all CAs must be root certificates)\"),\n            Self::NoIssuer =\u003e write!(f, \"Tried to look up a certificate with a null issuer field\")\n        }\n    }\n}","traces":[{"line":24,"address":[443744],"length":1,"stats":{"Line":1},"fn_name":"new"},{"line":25,"address":[443752],"length":1,"stats":{"Line":1},"fn_name":null},{"line":33,"address":[444586,443776,444900],"length":1,"stats":{"Line":1},"fn_name":"new_from_pem"},{"line":34,"address":[443809,443943],"length":1,"stats":{"Line":1},"fn_name":null},{"line":36,"address":[443933],"length":1,"stats":{"Line":1},"fn_name":null},{"line":38,"address":[444836,444165,444715,444071],"length":1,"stats":{"Line":3},"fn_name":null},{"line":39,"address":[444387,444548,444466],"length":1,"stats":{"Line":3},"fn_name":null},{"line":40,"address":[444807,444597],"length":1,"stats":{"Line":2},"fn_name":null},{"line":41,"address":[444634],"length":1,"stats":{"Line":0},"fn_name":null},{"line":45,"address":[444841],"length":1,"stats":{"Line":1},"fn_name":null},{"line":51,"address":[446350,444928],"length":1,"stats":{"Line":1},"fn_name":"add_ca_certificate"},{"line":52,"address":[445000,445158],"length":1,"stats":{"Line":1},"fn_name":null},{"line":54,"address":[445138],"length":1,"stats":{"Line":1},"fn_name":null},{"line":55,"address":[445327,445238],"length":1,"stats":{"Line":0},"fn_name":null},{"line":58,"address":[445352,445594,445231],"length":1,"stats":{"Line":3},"fn_name":null},{"line":59,"address":[445763],"length":1,"stats":{"Line":0},"fn_name":null},{"line":62,"address":[445839,445756,445957],"length":1,"stats":{"Line":2},"fn_name":null},{"line":63,"address":[446114,445929],"length":1,"stats":{"Line":2},"fn_name":null},{"line":65,"address":[446264,446141],"length":1,"stats":{"Line":2},"fn_name":null},{"line":67,"address":[446145,446278],"length":1,"stats":{"Line":2},"fn_name":null},{"line":69,"address":[446294],"length":1,"stats":{"Line":1},"fn_name":null},{"line":73,"address":[446400],"length":1,"stats":{"Line":1},"fn_name":"blocklist_fingerprint"},{"line":74,"address":[446419],"length":1,"stats":{"Line":1},"fn_name":null},{"line":78,"address":[446528,446464],"length":1,"stats":{"Line":1},"fn_name":"reset_blocklist"},{"line":79,"address":[446482,446560],"length":1,"stats":{"Line":2},"fn_name":null},{"line":83,"address":[446592,446880,446852],"length":1,"stats":{"Line":1},"fn_name":"is_blocklisted"},{"line":84,"address":[446734,446614,446791],"length":1,"stats":{"Line":1},"fn_name":null},{"line":85,"address":[446761,446813],"length":1,"stats":{"Line":2},"fn_name":null},{"line":91,"address":[446896,447030],"length":1,"stats":{"Line":1},"fn_name":"get_ca_for_cert"},{"line":92,"address":[446929],"length":1,"stats":{"Line":1},"fn_name":null},{"line":93,"address":[447095],"length":1,"stats":{"Line":0},"fn_name":null},{"line":96,"address":[447062],"length":1,"stats":{"Line":1},"fn_name":null},{"line":100,"address":[447136],"length":1,"stats":{"Line":1},"fn_name":"get_fingerprints"},{"line":101,"address":[447155],"length":1,"stats":{"Line":1},"fn_name":null},{"line":117,"address":[447200],"length":1,"stats":{"Line":0},"fn_name":"fmt"},{"line":118,"address":[447227],"length":1,"stats":{"Line":0},"fn_name":null},{"line":119,"address":[447259],"length":1,"stats":{"Line":0},"fn_name":null},{"line":120,"address":[447316],"length":1,"stats":{"Line":0},"fn_name":null},{"line":121,"address":[447373],"length":1,"stats":{"Line":0},"fn_name":null}],"covered":30,"coverable":39},{"path":["/","home","core","prj","e3t","trifid","trifid-pki","src","cert.rs"],"content":"//! Manage Nebula PKI Certificates\n//! This is pretty much a direct port of nebula/cert/cert.go\n\nuse std::error::Error;\nuse std::fmt::{Display, Formatter};\nuse std::net::Ipv4Addr;\nuse std::ops::Add;\nuse std::time::{Duration, SystemTime, UNIX_EPOCH};\nuse ed25519_dalek::{Signature, Signer, SigningKey, Verifier, VerifyingKey};\nuse ipnet::{Ipv4Net};\nuse pem::Pem;\nuse quick_protobuf::{BytesReader, MessageRead, MessageWrite, Writer};\nuse sha2::Sha256;\nuse crate::ca::NebulaCAPool;\nuse crate::cert_codec::{RawNebulaCertificate, RawNebulaCertificateDetails};\nuse sha2::Digest;\n\n/// The length, in bytes, of public keys\npub const PUBLIC_KEY_LENGTH: i32 = 32;\n\n/// The PEM banner for certificates\npub const CERT_BANNER: \u0026str = \"NEBULA CERTIFICATE\";\n/// The PEM banner for X25519 private keys\npub const X25519_PRIVATE_KEY_BANNER: \u0026str = \"NEBULA X25519 PRIVATE KEY\";\n/// The PEM banner for X25519 public keys\npub const X25519_PUBLIC_KEY_BANNER: \u0026str = \"NEBULA X25519 PUBLIC KEY\";\n/// The PEM banner for Ed25519 private keys\npub const ED25519_PRIVATE_KEY_BANNER: \u0026str = \"NEBULA ED25519 PRIVATE KEY\";\n/// The PEM banner for Ed25519 public keys\npub const ED25519_PUBLIC_KEY_BANNER: \u0026str = \"NEBULA ED25519 PUBLIC KEY\";\n\n/// A Nebula PKI certificate\n#[derive(Debug, Clone)]\npub struct NebulaCertificate {\n    /// The signed data of this certificate\n    pub details: NebulaCertificateDetails,\n    /// The Ed25519 signature of this certificate\n    pub signature: Vec\u003cu8\u003e\n}\n\n/// The signed details contained in a Nebula PKI certificate\n#[derive(Debug, Clone)]\npub struct NebulaCertificateDetails {\n    /// The name of the identity this certificate was issued for\n    pub name: String,\n    /// The IPv4 addresses issued to this node\n    pub ips: Vec\u003cIpv4Net\u003e,\n    /// The IPv4 subnets this node is responsible for routing\n    pub subnets: Vec\u003cIpv4Net\u003e,\n    /// The groups this node is a part of\n    pub groups: Vec\u003cString\u003e,\n    /// Certificate start date and time\n    pub not_before: SystemTime,\n    /// Certificate expiry date and time\n    pub not_after: SystemTime,\n    /// Public key\n    pub public_key: [u8; PUBLIC_KEY_LENGTH as usize],\n    /// Is this node a CA?\n    pub is_ca: bool,\n    /// SHA256 of issuer certificate. If blank, this cert is self-signed.\n    pub issuer: String\n}\n\n/// A list of errors that can occur parsing certificates\n#[derive(Debug)]\npub enum CertificateError {\n    /// Attempted to deserialize a certificate from an empty byte array\n    EmptyByteArray,\n    /// The encoded Details field is null\n    NilDetails,\n    /// The encoded Ips field is not formatted correctly\n    IpsNotPairs,\n    /// The encoded Subnets field is not formatted correctly\n    SubnetsNotPairs,\n    /// Signatures are expected to be 64 bytes but the signature on the certificate was a different length\n    WrongSigLength,\n    /// Public keys are expected to be 32 bytes but the public key on this cert is not\n    WrongKeyLength,\n    /// Certificates should have the PEM tag `NEBULA CERTIFICATE`, but this block did not\n    WrongPemTag,\n    /// This certificate either is not yet valid or has already expired\n    Expired,\n    /// The public key does not match the expected value\n    KeyMismatch\n}\nimpl Display for CertificateError {\n    fn fmt(\u0026self, f: \u0026mut Formatter\u003c'_\u003e) -\u003e std::fmt::Result {\n        match self {\n            Self::EmptyByteArray =\u003e write!(f, \"Certificate bytearray is empty\"),\n            Self::NilDetails =\u003e write!(f, \"The encoded Details field is null\"),\n            Self::IpsNotPairs =\u003e write!(f, \"encoded IPs should be in pairs, an odd number was found\"),\n            Self::SubnetsNotPairs =\u003e write!(f, \"encoded subnets should be in pairs, an odd number was found\"),\n            Self::WrongSigLength =\u003e write!(f, \"Signature should be 64 bytes but is a different size\"),\n            Self::WrongKeyLength =\u003e write!(f, \"Public keys are expected to be 32 bytes but the public key on this cert is not\"),\n            Self::WrongPemTag =\u003e write!(f, \"Certificates should have the PEM tag `NEBULA CERTIFICATE`, but this block did not\"),\n            Self::Expired =\u003e write!(f, \"This certificate either is not yet valid or has already expired\"),\n            Self::KeyMismatch =\u003e write!(f, \"Key does not match expected value\")\n        }\n    }\n}\nimpl Error for CertificateError {}\n\nfn map_cidr_pairs(pairs: \u0026[u32]) -\u003e Result\u003cVec\u003cIpv4Net\u003e, Box\u003cdyn Error\u003e\u003e {\n    let mut res_vec = vec![];\n    for pair in pairs.chunks(2) {\n        res_vec.push(Ipv4Net::with_netmask(Ipv4Addr::from(pair[0]), Ipv4Addr::from(pair[1]))?);\n    }\n    Ok(res_vec)\n}\n\nimpl Display for NebulaCertificate {\n    #[allow(clippy::unwrap_used)]\n    fn fmt(\u0026self, f: \u0026mut Formatter\u003c'_\u003e) -\u003e std::fmt::Result {\n        writeln!(f, \"NebulaCertificate {{\")?;\n        writeln!(f, \"   Details {{\")?;\n        writeln!(f, \"       Name: {}\", self.details.name)?;\n        writeln!(f, \"       Ips: {:?}\", self.details.ips)?;\n        writeln!(f, \"       Subnets: {:?}\", self.details.subnets)?;\n        writeln!(f, \"       Groups: {:?}\", self.details.groups)?;\n        writeln!(f, \"       Not before: {:?}\", self.details.not_before)?;\n        writeln!(f, \"       Not after: {:?}\", self.details.not_after)?;\n        writeln!(f, \"       Is CA: {}\", self.details.is_ca)?;\n        writeln!(f, \"       Issuer: {}\", self.details.issuer)?;\n        writeln!(f, \"       Public key: {}\", hex::encode(self.details.public_key))?;\n        writeln!(f, \"   }}\")?;\n        writeln!(f, \"   Fingerprint: {}\", self.sha256sum().unwrap())?;\n        writeln!(f, \"   Signature: {}\", hex::encode(self.signature.clone()))?;\n        writeln!(f, \"}}\")\n    }\n}\n\n/// Given a protobuf-encoded certificate bytearray, deserialize it into a `NebulaCertificate` object.\n/// # Errors\n/// This function will return an error if there is a protobuf parsing error, or if the certificate data is invalid.\n/// # Panics\npub fn deserialize_nebula_certificate(bytes: \u0026[u8]) -\u003e Result\u003cNebulaCertificate, Box\u003cdyn Error\u003e\u003e {\n    if bytes.is_empty() {\n        return Err(CertificateError::EmptyByteArray.into())\n    }\n\n    let mut reader = BytesReader::from_bytes(bytes);\n\n    let raw_cert = RawNebulaCertificate::from_reader(\u0026mut reader, bytes)?;\n\n    let details = raw_cert.Details.ok_or(CertificateError::NilDetails)?;\n\n    if details.Ips.len() % 2 != 0 {\n        return Err(CertificateError::IpsNotPairs.into())\n    }\n\n    if details.Subnets.len() % 2 != 0 {\n        return Err(CertificateError::SubnetsNotPairs.into())\n    }\n\n    let mut nebula_cert;\n    #[allow(clippy::cast_sign_loss)]\n    {\n        nebula_cert = NebulaCertificate {\n            details: NebulaCertificateDetails {\n                name: details.Name.to_string(),\n                ips: map_cidr_pairs(\u0026details.Ips)?,\n                subnets: map_cidr_pairs(\u0026details.Subnets)?,\n                groups: details.Groups.iter().map(std::string::ToString::to_string).collect(),\n                not_before: SystemTime::UNIX_EPOCH.add(Duration::from_secs(details.NotBefore as u64)),\n                not_after: SystemTime::UNIX_EPOCH.add(Duration::from_secs(details.NotAfter as u64)),\n                public_key: [0u8; 32],\n                is_ca: details.IsCA,\n                issuer: hex::encode(details.Issuer),\n            },\n            signature: vec![],\n        };\n    }\n\n    nebula_cert.signature = raw_cert.Signature;\n\n    if details.PublicKey.len() != 32 {\n        return Err(CertificateError::WrongKeyLength.into())\n    }\n\n    #[allow(clippy::unwrap_used)] { nebula_cert.details.public_key = details.PublicKey.try_into().unwrap(); }\n\n    Ok(nebula_cert)\n}\n\n/// A list of errors that can occur parsing keys\n#[derive(Debug)]\npub enum KeyError {\n    /// Keys should have their associated PEM tags but this had the wrong one\n    WrongPemTag\n}\nimpl Display for KeyError {\n    fn fmt(\u0026self, f: \u0026mut Formatter\u003c'_\u003e) -\u003e std::fmt::Result {\n        match self {\n            Self::WrongPemTag =\u003e write!(f, \"Keys should have their associated PEM tags but this had the wrong one\")\n        }\n    }\n}\nimpl Error for KeyError {}\n\n\n/// Deserialize the first PEM block in the given byte array into a `NebulaCertificate`\n/// # Errors\n/// This function will return an error if the PEM data is invalid, or if there is an error parsing the certificate (see `deserialize_nebula_certificate`)\npub fn deserialize_nebula_certificate_from_pem(bytes: \u0026[u8]) -\u003e Result\u003cNebulaCertificate, Box\u003cdyn Error\u003e\u003e {\n    let pem = pem::parse(bytes)?;\n    if pem.tag != CERT_BANNER {\n        return Err(CertificateError::WrongPemTag.into())\n    }\n    deserialize_nebula_certificate(\u0026pem.contents)\n}\n\n/// Simple helper to PEM encode an X25519 private key\npub fn serialize_x25519_private(bytes: \u0026[u8]) -\u003e Vec\u003cu8\u003e {\n    pem::encode(\u0026Pem {\n        tag: X25519_PRIVATE_KEY_BANNER.to_string(),\n        contents: bytes.to_vec(),\n    }).as_bytes().to_vec()\n}\n\n/// Simple helper to PEM encode an X25519 public key\npub fn serialize_x25519_public(bytes: \u0026[u8]) -\u003e Vec\u003cu8\u003e {\n    pem::encode(\u0026Pem {\n        tag: X25519_PUBLIC_KEY_BANNER.to_string(),\n        contents: bytes.to_vec(),\n    }).as_bytes().to_vec()\n}\n\n/// Attempt to deserialize a PEM encoded X25519 private key\n/// # Errors\n/// This function will return an error if the PEM data is invalid or has the wrong tag\npub fn deserialize_x25519_private(bytes: \u0026[u8]) -\u003e Result\u003cVec\u003cu8\u003e, Box\u003cdyn Error\u003e\u003e {\n    let pem = pem::parse(bytes)?;\n    if pem.tag != X25519_PRIVATE_KEY_BANNER {\n        return Err(KeyError::WrongPemTag.into())\n    }\n    Ok(pem.contents)\n}\n\n/// Attempt to deserialize a PEM encoded X25519 public key\n/// # Errors\n/// This function will return an error if the PEM data is invalid or has the wrong tag\npub fn deserialize_x25519_public(bytes: \u0026[u8]) -\u003e Result\u003cVec\u003cu8\u003e, Box\u003cdyn Error\u003e\u003e {\n    let pem = pem::parse(bytes)?;\n    if pem.tag != X25519_PUBLIC_KEY_BANNER {\n        return Err(KeyError::WrongPemTag.into())\n    }\n    Ok(pem.contents)\n}\n\n/// Simple helper to PEM encode an Ed25519 private key\npub fn serialize_ed25519_private(bytes: \u0026[u8]) -\u003e Vec\u003cu8\u003e {\n    pem::encode(\u0026Pem {\n        tag: ED25519_PRIVATE_KEY_BANNER.to_string(),\n        contents: bytes.to_vec(),\n    }).as_bytes().to_vec()\n}\n\n/// Simple helper to PEM encode an Ed25519 public key\npub fn serialize_ed25519_public(bytes: \u0026[u8]) -\u003e Vec\u003cu8\u003e {\n    pem::encode(\u0026Pem {\n        tag: ED25519_PUBLIC_KEY_BANNER.to_string(),\n        contents: bytes.to_vec(),\n    }).as_bytes().to_vec()\n}\n\n/// Attempt to deserialize a PEM encoded Ed25519 private key\n/// # Errors\n/// This function will return an error if the PEM data is invalid or has the wrong tag\npub fn deserialize_ed25519_private(bytes: \u0026[u8]) -\u003e Result\u003cVec\u003cu8\u003e, Box\u003cdyn Error\u003e\u003e {\n    let pem = pem::parse(bytes)?;\n    if pem.tag != ED25519_PRIVATE_KEY_BANNER {\n        return Err(KeyError::WrongPemTag.into())\n    }\n    Ok(pem.contents)\n}\n\n/// Attempt to deserialize a PEM encoded Ed25519 public key\n/// # Errors\n/// This function will return an error if the PEM data is invalid or has the wrong tag\npub fn deserialize_ed25519_public(bytes: \u0026[u8]) -\u003e Result\u003cVec\u003cu8\u003e, Box\u003cdyn Error\u003e\u003e {\n    let pem = pem::parse(bytes)?;\n    if pem.tag != ED25519_PUBLIC_KEY_BANNER {\n        return Err(KeyError::WrongPemTag.into())\n    }\n    Ok(pem.contents)\n}\n\nimpl NebulaCertificate {\n    /// Sign a nebula certificate with the provided private key\n    /// # Errors\n    /// This function will return an error if the certificate could not be serialized or signed.\n    pub fn sign(\u0026mut self, key: \u0026SigningKey) -\u003e Result\u003c(), Box\u003cdyn Error\u003e\u003e {\n        let mut out = Vec::new();\n        let mut writer = Writer::new(\u0026mut out);\n        self.get_raw_details().write_message(\u0026mut writer)?;\n\n        self.signature = key.sign(\u0026out).to_vec();\n        Ok(())\n    }\n\n    /// Verify the signature on a certificate with the provided public key\n    /// # Errors\n    /// This function will return an error if the certificate could not be serialized or the signature could not be checked.\n    pub fn check_signature(\u0026self, key: \u0026VerifyingKey) -\u003e Result\u003cbool, Box\u003cdyn Error\u003e\u003e {\n        let mut out = Vec::new();\n        let mut writer = Writer::new(\u0026mut out);\n        self.get_raw_details().write_message(\u0026mut writer)?;\n\n        let sig = Signature::from_slice(\u0026self.signature)?;\n\n        Ok(key.verify(\u0026out, \u0026sig).is_ok())\n    }\n\n    /// Returns true if the signature is too young or too old compared to the provided time\n    pub fn expired(\u0026self, time: SystemTime) -\u003e bool {\n        self.details.not_before \u003e time || self.details.not_after \u003c time\n    }\n\n    /// Verify will ensure a certificate is good in all respects (expiry, group membership, signature, cert blocklist, etc)\n    /// # Errors\n    /// This function will return an error if there is an error parsing the cert or the CA pool.\n    pub fn verify(\u0026self, time: SystemTime, ca_pool: \u0026NebulaCAPool) -\u003e Result\u003cCertificateValidity, Box\u003cdyn Error\u003e\u003e {\n        if ca_pool.is_blocklisted(self) {\n            return Ok(CertificateValidity::Blocklisted);\n        }\n\n        let Some(signer) = ca_pool.get_ca_for_cert(self)? else { return Ok(CertificateValidity::NotSignedByThisCAPool) };\n\n        if signer.expired(time) {\n            return Ok(CertificateValidity::RootCertExpired)\n        }\n\n        if self.expired(time) {\n            return Ok(CertificateValidity::CertExpired)\n        }\n\n        if !self.check_signature(\u0026VerifyingKey::from_bytes(\u0026signer.details.public_key)?)? {\n            return Ok(CertificateValidity::BadSignature)\n        }\n\n        Ok(self.check_root_constraints(signer))\n    }\n\n    /// Make sure that this certificate does not break any of the constraints set by the signing certificate\n    pub fn check_root_constraints(\u0026self, signer: \u0026Self) -\u003e CertificateValidity {\n        // Make sure this cert doesn't expire after the signer\n        println!(\"{:?} {:?}\", signer.details.not_before, self.details.not_before);\n        if signer.details.not_before \u003c self.details.not_before {\n            return CertificateValidity::CertExpiresAfterSigner;\n        }\n\n        // Make sure this cert doesn't come into validity before the root\n        if signer.details.not_before \u003e self.details.not_before {\n            return CertificateValidity::CertValidBeforeSigner;\n        }\n\n        // If the signer contains a limited set of groups, make sure this cert only has a subset of them\n        if !signer.details.groups.is_empty() {\n            println!(\"root groups: {:?}, child groups: {:?}\", signer.details.groups, self.details.groups);\n            for group in \u0026self.details.groups {\n                if !signer.details.groups.contains(group) {\n                    return CertificateValidity::GroupNotPresentOnSigner;\n                }\n            }\n        }\n\n        // If the signer contains a limited set of IP ranges, make sure the cert only contains a subset\n        if !signer.details.ips.is_empty() {\n            for ip in \u0026self.details.ips {\n                if !net_match(*ip, \u0026signer.details.ips) {\n                    return CertificateValidity::IPNotPresentOnSigner;\n                }\n            }\n        }\n\n        // If the signer contains a limited set of subnets, make sure the cert only contains a subset\n        if !signer.details.subnets.is_empty() {\n            for subnet in \u0026self.details.subnets {\n                if !net_match(*subnet, \u0026signer.details.subnets) {\n                    return CertificateValidity::SubnetNotPresentOnSigner;\n                }\n            }\n        }\n\n        CertificateValidity::Ok\n    }\n\n    #[allow(clippy::unwrap_used)]\n    /// Verify if the given private key corresponds to the public key contained in this certificate\n    /// # Errors\n    /// This function will return an error if either keys are invalid.\n    /// # Panics\n    /// This function, while containing calls to unwrap, has proper bounds checking and will not panic.\n    pub fn verify_private_key(\u0026self, key: \u0026[u8]) -\u003e Result\u003c(), Box\u003cdyn Error\u003e\u003e {\n        if self.details.is_ca {\n            // convert the keys\n            if key.len() != 64 {\n                return Err(\"key not 64-bytes long\".into())\n            }\n\n\n            let secret = SigningKey::from_keypair_bytes(key.try_into().unwrap())?;\n            let pub_key = secret.verifying_key().to_bytes();\n            if pub_key != self.details.public_key {\n                return Err(CertificateError::KeyMismatch.into());\n            }\n\n            return Ok(());\n        }\n\n        if key.len() != 32 {\n            return Err(\"key not 32-bytes long\".into())\n        }\n\n        let pubkey_raw = SigningKey::from_bytes(key.try_into()?).verifying_key();\n        let pubkey = pubkey_raw.as_bytes();\n\n        println!(\"{} {}\", hex::encode(pubkey), hex::encode(self.details.public_key));\n        if *pubkey != self.details.public_key {\n            return Err(CertificateError::KeyMismatch.into());\n        }\n\n        Ok(())\n    }\n\n\n    /// Get a protobuf-ready raw struct, ready for serialization\n    #[allow(clippy::expect_used)]\n    #[allow(clippy::cast_possible_wrap)]\n    /// # Panics\n    /// This function will panic if time went backwards, or if the certificate contains extremely invalid data.\n    pub fn get_raw_details(\u0026self) -\u003e RawNebulaCertificateDetails {\n\n        let mut raw = RawNebulaCertificateDetails {\n            Name: self.details.name.clone(),\n            Ips: vec![],\n            Subnets: vec![],\n            Groups: self.details.groups.iter().map(std::convert::Into::into).collect(),\n            NotBefore: self.details.not_before.duration_since(UNIX_EPOCH).expect(\"Time went backwards\").as_secs() as i64,\n            NotAfter: self.details.not_after.duration_since(UNIX_EPOCH).expect(\"Time went backwards\").as_secs() as i64,\n            PublicKey: self.details.public_key.into(),\n            IsCA: self.details.is_ca,\n            Issuer: hex::decode(\u0026self.details.issuer).expect(\"Issuer was not a hex-encoded value\"),\n        };\n\n        for ip_net in \u0026self.details.ips {\n            raw.Ips.push(ip_net.addr().into());\n            raw.Ips.push(ip_net.netmask().into());\n        }\n\n        for subnet in \u0026self.details.subnets {\n            raw.Subnets.push(subnet.addr().into());\n            raw.Subnets.push(subnet.netmask().into());\n        }\n\n        raw\n    }\n\n    /// Will serialize this cert into a protobuf byte array.\n    /// # Errors\n    /// This function will return an error if protobuf was unable to serialize the data.\n    pub fn serialize(\u0026self) -\u003e Result\u003cVec\u003cu8\u003e, Box\u003cdyn Error\u003e\u003e {\n        let raw_cert = RawNebulaCertificate {\n            Details: Some(self.get_raw_details()),\n            Signature: self.signature.clone(),\n        };\n\n        let mut out = vec![];\n        let mut writer = Writer::new(\u0026mut out);\n        raw_cert.write_message(\u0026mut writer)?;\n\n        Ok(out)\n    }\n\n    /// Will serialize this cert into a PEM byte array.\n    /// # Errors\n    /// This function will return an error if protobuf was unable to serialize the data.\n    pub fn serialize_to_pem(\u0026self) -\u003e Result\u003cVec\u003cu8\u003e, Box\u003cdyn Error\u003e\u003e {\n        let pbuf_bytes = self.serialize()?;\n\n        Ok(pem::encode(\u0026Pem {\n            tag: CERT_BANNER.to_string(),\n            contents: pbuf_bytes,\n        }).as_bytes().to_vec())\n    }\n\n    /// Get the fingerprint of this certificate\n    /// # Errors\n    /// This functiom will return an error if protobuf was unable to serialize the cert.\n    pub fn sha256sum(\u0026self) -\u003e Result\u003cString, Box\u003cdyn Error\u003e\u003e {\n        let pbuf_bytes = self.serialize()?;\n\n        let mut hasher = Sha256::new();\n        hasher.update(pbuf_bytes);\n\n        Ok(hex::encode(hasher.finalize()))\n    }\n}\n\n/// A list of possible errors that can happen validating a certificate\n#[derive(Eq, PartialEq, Debug)]\npub enum CertificateValidity {\n    /// There are no issues with this certificate\n    Ok,\n    /// This cert has been blocklisted in the given CA pool\n    Blocklisted,\n    /// The certificate that signed this cert is expired\n    RootCertExpired,\n    /// This cert is expired\n    CertExpired,\n    /// This cert's signature is invalid\n    BadSignature,\n    /// This cert was not signed by any CAs in the CA pool\n    NotSignedByThisCAPool,\n    /// This cert expires after the signer's cert expires\n    CertExpiresAfterSigner,\n    /// This cert enters validity before the signer's cert does\n    CertValidBeforeSigner,\n    /// A group present on this certificate is not present on the signer's certificate\n    GroupNotPresentOnSigner,\n    /// An IP present on this certificate is not present on the signer's certificate\n    IPNotPresentOnSigner,\n    /// A subnet on this certificate is not present on the signer's certificate\n    SubnetNotPresentOnSigner\n}\n\nfn net_match(cert_ip: Ipv4Net, root_ips: \u0026Vec\u003cIpv4Net\u003e) -\u003e bool {\n    for net in root_ips {\n        if net.contains(\u0026cert_ip) {\n            return true;\n        }\n    }\n    false\n}","traces":[{"line":87,"address":[532032],"length":1,"stats":{"Line":0},"fn_name":"fmt"},{"line":88,"address":[532059],"length":1,"stats":{"Line":0},"fn_name":null},{"line":89,"address":[532090],"length":1,"stats":{"Line":0},"fn_name":null},{"line":90,"address":[532150],"length":1,"stats":{"Line":0},"fn_name":null},{"line":91,"address":[532210],"length":1,"stats":{"Line":0},"fn_name":null},{"line":92,"address":[532270],"length":1,"stats":{"Line":0},"fn_name":null},{"line":93,"address":[532336],"length":1,"stats":{"Line":0},"fn_name":null},{"line":94,"address":[532402],"length":1,"stats":{"Line":0},"fn_name":null},{"line":95,"address":[532468],"length":1,"stats":{"Line":0},"fn_name":null},{"line":96,"address":[532531],"length":1,"stats":{"Line":0},"fn_name":null},{"line":97,"address":[532594],"length":1,"stats":{"Line":0},"fn_name":null},{"line":103,"address":[532672,533603],"length":1,"stats":{"Line":1},"fn_name":"map_cidr_pairs"},{"line":104,"address":[532715],"length":1,"stats":{"Line":1},"fn_name":null},{"line":105,"address":[533037,532752,532813],"length":1,"stats":{"Line":3},"fn_name":null},{"line":106,"address":[533598,533079],"length":1,"stats":{"Line":2},"fn_name":null},{"line":108,"address":[532950],"length":1,"stats":{"Line":1},"fn_name":null},{"line":113,"address":[535685,533632],"length":1,"stats":{"Line":1},"fn_name":"fmt"},{"line":114,"address":[533665,533866],"length":1,"stats":{"Line":1},"fn_name":null},{"line":115,"address":[533763,534044],"length":1,"stats":{"Line":1},"fn_name":null},{"line":116,"address":[534206,533913],"length":1,"stats":{"Line":1},"fn_name":null},{"line":117,"address":[534368,534076],"length":1,"stats":{"Line":1},"fn_name":null},{"line":118,"address":[534238,534533],"length":1,"stats":{"Line":1},"fn_name":null},{"line":119,"address":[534400,534695],"length":1,"stats":{"Line":1},"fn_name":null},{"line":120,"address":[534857,534565],"length":1,"stats":{"Line":1},"fn_name":null},{"line":121,"address":[534727,535022],"length":1,"stats":{"Line":1},"fn_name":null},{"line":122,"address":[535185,534889],"length":1,"stats":{"Line":1},"fn_name":null},{"line":123,"address":[535054,535292],"length":1,"stats":{"Line":1},"fn_name":null},{"line":124,"address":[535319,535217,535631],"length":1,"stats":{"Line":1},"fn_name":null},{"line":125,"address":[535790,535528],"length":1,"stats":{"Line":1},"fn_name":null},{"line":126,"address":[536112,535729,535817],"length":1,"stats":{"Line":1},"fn_name":null},{"line":127,"address":[536034,536166,536445],"length":1,"stats":{"Line":1},"fn_name":null},{"line":128,"address":[536375],"length":1,"stats":{"Line":1},"fn_name":null},{"line":136,"address":[541549,536512,538040],"length":1,"stats":{"Line":1},"fn_name":"deserialize_nebula_certificate"},{"line":137,"address":[536589],"length":1,"stats":{"Line":1},"fn_name":null},{"line":138,"address":[536783],"length":1,"stats":{"Line":1},"fn_name":null},{"line":141,"address":[536667],"length":1,"stats":{"Line":1},"fn_name":null},{"line":143,"address":[536897,536711,537046],"length":1,"stats":{"Line":2},"fn_name":null},{"line":145,"address":[537450,537272,536957],"length":1,"stats":{"Line":2},"fn_name":null},{"line":147,"address":[537597,537412],"length":1,"stats":{"Line":2},"fn_name":null},{"line":148,"address":[537634],"length":1,"stats":{"Line":1},"fn_name":null},{"line":151,"address":[537607,537741],"length":1,"stats":{"Line":2},"fn_name":null},{"line":152,"address":[537774],"length":1,"stats":{"Line":1},"fn_name":null},{"line":158,"address":[539558],"length":1,"stats":{"Line":1},"fn_name":null},{"line":159,"address":[539230],"length":1,"stats":{"Line":1},"fn_name":null},{"line":160,"address":[537751],"length":1,"stats":{"Line":1},"fn_name":null},{"line":161,"address":[537897,538051,538161,537997],"length":1,"stats":{"Line":3},"fn_name":null},{"line":162,"address":[538115,538364,538515],"length":1,"stats":{"Line":2},"fn_name":null},{"line":163,"address":[538792,538469],"length":1,"stats":{"Line":2},"fn_name":null},{"line":164,"address":[538974,538885],"length":1,"stats":{"Line":2},"fn_name":null},{"line":165,"address":[539031],"length":1,"stats":{"Line":1},"fn_name":null},{"line":166,"address":[539115],"length":1,"stats":{"Line":1},"fn_name":null},{"line":167,"address":[539134],"length":1,"stats":{"Line":1},"fn_name":null},{"line":168,"address":[539145],"length":1,"stats":{"Line":1},"fn_name":null},{"line":170,"address":[539461],"length":1,"stats":{"Line":1},"fn_name":null},{"line":174,"address":[539633],"length":1,"stats":{"Line":1},"fn_name":null},{"line":176,"address":[539815],"length":1,"stats":{"Line":1},"fn_name":null},{"line":177,"address":[539916],"length":1,"stats":{"Line":1},"fn_name":null},{"line":182,"address":[540877],"length":1,"stats":{"Line":1},"fn_name":null},{"line":192,"address":[541584],"length":1,"stats":{"Line":0},"fn_name":"fmt"},{"line":194,"address":[541602],"length":1,"stats":{"Line":0},"fn_name":null},{"line":204,"address":[541664,542141],"length":1,"stats":{"Line":1},"fn_name":"deserialize_nebula_certificate_from_pem"},{"line":205,"address":[541861,541697],"length":1,"stats":{"Line":2},"fn_name":null},{"line":206,"address":[541993,541835],"length":1,"stats":{"Line":2},"fn_name":null},{"line":207,"address":[542025],"length":1,"stats":{"Line":0},"fn_name":null},{"line":209,"address":[542118,541999],"length":1,"stats":{"Line":2},"fn_name":null},{"line":213,"address":[542387,542176],"length":1,"stats":{"Line":1},"fn_name":"serialize_x25519_private"},{"line":214,"address":[542314,542456,542526],"length":1,"stats":{"Line":3},"fn_name":null},{"line":215,"address":[542219],"length":1,"stats":{"Line":1},"fn_name":null},{"line":216,"address":[542254],"length":1,"stats":{"Line":1},"fn_name":null},{"line":217,"address":[542273],"length":1,"stats":{"Line":0},"fn_name":null},{"line":221,"address":[542592,542803],"length":1,"stats":{"Line":1},"fn_name":"serialize_x25519_public"},{"line":222,"address":[542872,542730,542942],"length":1,"stats":{"Line":3},"fn_name":null},{"line":223,"address":[542635],"length":1,"stats":{"Line":1},"fn_name":null},{"line":224,"address":[542670],"length":1,"stats":{"Line":1},"fn_name":null},{"line":225,"address":[542689],"length":1,"stats":{"Line":0},"fn_name":null},{"line":231,"address":[543008,543506],"length":1,"stats":{"Line":1},"fn_name":"deserialize_x25519_private"},{"line":232,"address":[543202,543041],"length":1,"stats":{"Line":2},"fn_name":null},{"line":233,"address":[543176,543334],"length":1,"stats":{"Line":2},"fn_name":null},{"line":234,"address":[543443],"length":1,"stats":{"Line":0},"fn_name":null},{"line":236,"address":[543345],"length":1,"stats":{"Line":1},"fn_name":null},{"line":242,"address":[544034,543536],"length":1,"stats":{"Line":1},"fn_name":"deserialize_x25519_public"},{"line":243,"address":[543569,543730],"length":1,"stats":{"Line":2},"fn_name":null},{"line":244,"address":[543704,543862],"length":1,"stats":{"Line":2},"fn_name":null},{"line":245,"address":[543971],"length":1,"stats":{"Line":0},"fn_name":null},{"line":247,"address":[543873],"length":1,"stats":{"Line":1},"fn_name":null},{"line":251,"address":[544275,544064],"length":1,"stats":{"Line":1},"fn_name":"serialize_ed25519_private"},{"line":252,"address":[544414,544202,544344],"length":1,"stats":{"Line":3},"fn_name":null},{"line":253,"address":[544107],"length":1,"stats":{"Line":1},"fn_name":null},{"line":254,"address":[544142],"length":1,"stats":{"Line":1},"fn_name":null},{"line":255,"address":[544161],"length":1,"stats":{"Line":0},"fn_name":null},{"line":259,"address":[544480,544691],"length":1,"stats":{"Line":1},"fn_name":"serialize_ed25519_public"},{"line":260,"address":[544618,544760,544830],"length":1,"stats":{"Line":3},"fn_name":null},{"line":261,"address":[544523],"length":1,"stats":{"Line":1},"fn_name":null},{"line":262,"address":[544558],"length":1,"stats":{"Line":1},"fn_name":null},{"line":263,"address":[544577],"length":1,"stats":{"Line":0},"fn_name":null},{"line":269,"address":[545394,544896],"length":1,"stats":{"Line":1},"fn_name":"deserialize_ed25519_private"},{"line":270,"address":[544929,545090],"length":1,"stats":{"Line":2},"fn_name":null},{"line":271,"address":[545222,545064],"length":1,"stats":{"Line":2},"fn_name":null},{"line":272,"address":[545331],"length":1,"stats":{"Line":0},"fn_name":null},{"line":274,"address":[545233],"length":1,"stats":{"Line":1},"fn_name":null},{"line":280,"address":[545922,545424],"length":1,"stats":{"Line":1},"fn_name":"deserialize_ed25519_public"},{"line":281,"address":[545457,545618],"length":1,"stats":{"Line":2},"fn_name":null},{"line":282,"address":[545750,545592],"length":1,"stats":{"Line":2},"fn_name":null},{"line":283,"address":[545859],"length":1,"stats":{"Line":0},"fn_name":null},{"line":285,"address":[545761],"length":1,"stats":{"Line":1},"fn_name":null},{"line":292,"address":[546372,546674,545952],"length":1,"stats":{"Line":1},"fn_name":"sign"},{"line":293,"address":[545985],"length":1,"stats":{"Line":1},"fn_name":null},{"line":294,"address":[546009,546072],"length":1,"stats":{"Line":2},"fn_name":null},{"line":295,"address":[546085],"length":1,"stats":{"Line":1},"fn_name":null},{"line":297,"address":[546412],"length":1,"stats":{"Line":1},"fn_name":null},{"line":298,"address":[546649],"length":1,"stats":{"Line":1},"fn_name":null},{"line":304,"address":[547109,546704,547554],"length":1,"stats":{"Line":1},"fn_name":"check_signature"},{"line":305,"address":[546747],"length":1,"stats":{"Line":1},"fn_name":null},{"line":306,"address":[546834,546771],"length":1,"stats":{"Line":2},"fn_name":null},{"line":307,"address":[546847],"length":1,"stats":{"Line":1},"fn_name":null},{"line":309,"address":[547141,547402],"length":1,"stats":{"Line":2},"fn_name":null},{"line":311,"address":[547371,547616,547508],"length":1,"stats":{"Line":3},"fn_name":null},{"line":315,"address":[547712],"length":1,"stats":{"Line":1},"fn_name":"expired"},{"line":316,"address":[547734],"length":1,"stats":{"Line":1},"fn_name":null},{"line":322,"address":[547808],"length":1,"stats":{"Line":1},"fn_name":"verify"},{"line":323,"address":[547883],"length":1,"stats":{"Line":1},"fn_name":null},{"line":324,"address":[547960],"length":1,"stats":{"Line":1},"fn_name":null},{"line":327,"address":[548117,547984,548084,547902],"length":1,"stats":{"Line":3},"fn_name":null},{"line":329,"address":[548101],"length":1,"stats":{"Line":1},"fn_name":null},{"line":330,"address":[548163],"length":1,"stats":{"Line":1},"fn_name":null},{"line":333,"address":[548147],"length":1,"stats":{"Line":1},"fn_name":null},{"line":334,"address":[548239],"length":1,"stats":{"Line":1},"fn_name":null},{"line":337,"address":[548431,548183,548255],"length":1,"stats":{"Line":3},"fn_name":null},{"line":338,"address":[548541],"length":1,"stats":{"Line":0},"fn_name":null},{"line":341,"address":[548509],"length":1,"stats":{"Line":1},"fn_name":null},{"line":345,"address":[548560],"length":1,"stats":{"Line":1},"fn_name":"check_root_constraints"},{"line":347,"address":[548606],"length":1,"stats":{"Line":1},"fn_name":null},{"line":348,"address":[548732],"length":1,"stats":{"Line":1},"fn_name":null},{"line":349,"address":[548778],"length":1,"stats":{"Line":0},"fn_name":null},{"line":353,"address":[548759],"length":1,"stats":{"Line":1},"fn_name":null},{"line":354,"address":[548820],"length":1,"stats":{"Line":0},"fn_name":null},{"line":358,"address":[548800],"length":1,"stats":{"Line":1},"fn_name":null},{"line":359,"address":[548861],"length":1,"stats":{"Line":1},"fn_name":null},{"line":360,"address":[549000],"length":1,"stats":{"Line":1},"fn_name":null},{"line":361,"address":[549108],"length":1,"stats":{"Line":1},"fn_name":null},{"line":362,"address":[549144],"length":1,"stats":{"Line":1},"fn_name":null},{"line":368,"address":[548832],"length":1,"stats":{"Line":1},"fn_name":null},{"line":369,"address":[549188],"length":1,"stats":{"Line":1},"fn_name":null},{"line":370,"address":[549285],"length":1,"stats":{"Line":1},"fn_name":null},{"line":371,"address":[549348],"length":1,"stats":{"Line":1},"fn_name":null},{"line":377,"address":[549159],"length":1,"stats":{"Line":1},"fn_name":null},{"line":378,"address":[549373],"length":1,"stats":{"Line":1},"fn_name":null},{"line":379,"address":[549470],"length":1,"stats":{"Line":1},"fn_name":null},{"line":380,"address":[549533],"length":1,"stats":{"Line":1},"fn_name":null},{"line":385,"address":[549358],"length":1,"stats":{"Line":1},"fn_name":null},{"line":394,"address":[549552,550149],"length":1,"stats":{"Line":1},"fn_name":"verify_private_key"},{"line":395,"address":[549607],"length":1,"stats":{"Line":1},"fn_name":null},{"line":397,"address":[549647],"length":1,"stats":{"Line":1},"fn_name":null},{"line":398,"address":[549743],"length":1,"stats":{"Line":0},"fn_name":null},{"line":402,"address":[549669,549800,549905],"length":1,"stats":{"Line":2},"fn_name":null},{"line":403,"address":[550030,549886],"length":1,"stats":{"Line":2},"fn_name":null},{"line":404,"address":[550053],"length":1,"stats":{"Line":1},"fn_name":null},{"line":405,"address":[550088],"length":1,"stats":{"Line":1},"fn_name":null},{"line":408,"address":[550074],"length":1,"stats":{"Line":1},"fn_name":null},{"line":411,"address":[549624],"length":1,"stats":{"Line":1},"fn_name":null},{"line":412,"address":[550263],"length":1,"stats":{"Line":0},"fn_name":null},{"line":415,"address":[550301,550210],"length":1,"stats":{"Line":2},"fn_name":null},{"line":416,"address":[550461],"length":1,"stats":{"Line":1},"fn_name":null},{"line":418,"address":[550498],"length":1,"stats":{"Line":1},"fn_name":null},{"line":419,"address":[550878],"length":1,"stats":{"Line":1},"fn_name":null},{"line":420,"address":[550904],"length":1,"stats":{"Line":1},"fn_name":null},{"line":423,"address":[550887],"length":1,"stats":{"Line":1},"fn_name":null},{"line":432,"address":[550960,552081],"length":1,"stats":{"Line":1},"fn_name":"get_raw_details"},{"line":435,"address":[550999],"length":1,"stats":{"Line":1},"fn_name":null},{"line":436,"address":[551028],"length":1,"stats":{"Line":1},"fn_name":null},{"line":437,"address":[551087],"length":1,"stats":{"Line":1},"fn_name":null},{"line":438,"address":[551234,551143],"length":1,"stats":{"Line":2},"fn_name":null},{"line":439,"address":[551335,551415],"length":1,"stats":{"Line":2},"fn_name":null},{"line":440,"address":[551525],"length":1,"stats":{"Line":1},"fn_name":null},{"line":441,"address":[551671],"length":1,"stats":{"Line":1},"fn_name":null},{"line":442,"address":[551725],"length":1,"stats":{"Line":1},"fn_name":null},{"line":443,"address":[551804,551738],"length":1,"stats":{"Line":2},"fn_name":null},{"line":446,"address":[552160,552288,552054],"length":1,"stats":{"Line":3},"fn_name":null},{"line":447,"address":[552309],"length":1,"stats":{"Line":1},"fn_name":null},{"line":448,"address":[552409],"length":1,"stats":{"Line":1},"fn_name":null},{"line":451,"address":[552511,552617,552256],"length":1,"stats":{"Line":3},"fn_name":null},{"line":452,"address":[552638],"length":1,"stats":{"Line":1},"fn_name":null},{"line":453,"address":[552738],"length":1,"stats":{"Line":1},"fn_name":null},{"line":462,"address":[553047,552832],"length":1,"stats":{"Line":1},"fn_name":"serialize"},{"line":464,"address":[552875],"length":1,"stats":{"Line":1},"fn_name":null},{"line":465,"address":[552912],"length":1,"stats":{"Line":1},"fn_name":null},{"line":468,"address":[553028],"length":1,"stats":{"Line":1},"fn_name":null},{"line":469,"address":[553173,553115],"length":1,"stats":{"Line":2},"fn_name":null},{"line":470,"address":[553373,553202],"length":1,"stats":{"Line":1},"fn_name":null},{"line":472,"address":[553262],"length":1,"stats":{"Line":1},"fn_name":null},{"line":478,"address":[553536,553887],"length":1,"stats":{"Line":1},"fn_name":"serialize_to_pem"},{"line":479,"address":[553561,553678],"length":1,"stats":{"Line":1},"fn_name":null},{"line":481,"address":[553962,554028,553796],"length":1,"stats":{"Line":3},"fn_name":null},{"line":482,"address":[553646],"length":1,"stats":{"Line":1},"fn_name":null},{"line":483,"address":[553770],"length":1,"stats":{"Line":1},"fn_name":null},{"line":490,"address":[554641,554672,554128],"length":1,"stats":{"Line":1},"fn_name":"sha256sum"},{"line":491,"address":[554152,554266],"length":1,"stats":{"Line":1},"fn_name":null},{"line":493,"address":[554255],"length":1,"stats":{"Line":1},"fn_name":null},{"line":494,"address":[554366],"length":1,"stats":{"Line":1},"fn_name":null},{"line":496,"address":[554423],"length":1,"stats":{"Line":1},"fn_name":null},{"line":527,"address":[554688],"length":1,"stats":{"Line":1},"fn_name":"net_match"},{"line":528,"address":[554802,554738],"length":1,"stats":{"Line":2},"fn_name":null},{"line":529,"address":[554812],"length":1,"stats":{"Line":1},"fn_name":null},{"line":530,"address":[554829],"length":1,"stats":{"Line":1},"fn_name":null},{"line":533,"address":[554795],"length":1,"stats":{"Line":1},"fn_name":null}],"covered":178,"coverable":205},{"path":["/","home","core","prj","e3t","trifid","trifid-pki","src","cert_codec.rs"],"content":"// Automatically generated rust module for 'cert_codec.proto' file\n\n#![allow(non_snake_case)]\n#![allow(non_upper_case_globals)]\n#![allow(non_camel_case_types)]\n#![allow(unused_imports)]\n#![allow(unknown_lints)]\n#![allow(clippy::all)]\n#![cfg_attr(rustfmt, rustfmt_skip)]\n#![allow(clippy::pedantic)]\n\nuse quick_protobuf::{MessageInfo, MessageRead, MessageWrite, BytesReader, Writer, WriterBackend, Result};\nuse quick_protobuf::sizeofs::*;\nuse super::*;\n\n#[allow(clippy::derive_partial_eq_without_eq)]\n#[derive(Debug, Default, PartialEq, Clone)]\npub struct RawNebulaCertificate {\n    pub Details: Option\u003ccert_codec::RawNebulaCertificateDetails\u003e,\n    pub Signature: Vec\u003cu8\u003e,\n}\n\nimpl\u003c'a\u003e MessageRead\u003c'a\u003e for RawNebulaCertificate {\n    fn from_reader(r: \u0026mut BytesReader, bytes: \u0026'a [u8]) -\u003e Result\u003cSelf\u003e {\n        let mut msg = Self::default();\n        while !r.is_eof() {\n            match r.next_tag(bytes) {\n                Ok(10) =\u003e msg.Details = Some(r.read_message::\u003ccert_codec::RawNebulaCertificateDetails\u003e(bytes)?),\n                Ok(18) =\u003e msg.Signature = r.read_bytes(bytes)?.to_owned(),\n                Ok(t) =\u003e { r.read_unknown(bytes, t)?; }\n                Err(e) =\u003e return Err(e),\n            }\n        }\n        Ok(msg)\n    }\n}\n\nimpl MessageWrite for RawNebulaCertificate {\n    fn get_size(\u0026self) -\u003e usize {\n        0\n        + self.Details.as_ref().map_or(0, |m| 1 + sizeof_len((m).get_size()))\n        + if self.Signature.is_empty() { 0 } else { 1 + sizeof_len((\u0026self.Signature).len()) }\n    }\n\n    fn write_message\u003cW: WriterBackend\u003e(\u0026self, w: \u0026mut Writer\u003cW\u003e) -\u003e Result\u003c()\u003e {\n        if let Some(ref s) = self.Details { w.write_with_tag(10, |w| w.write_message(s))?; }\n        if !self.Signature.is_empty() { w.write_with_tag(18, |w| w.write_bytes(\u0026**\u0026self.Signature))?; }\n        Ok(())\n    }\n}\n\n#[allow(clippy::derive_partial_eq_without_eq)]\n#[derive(Debug, Default, PartialEq, Clone)]\npub struct RawNebulaCertificateDetails {\n    pub Name: String,\n    pub Ips: Vec\u003cu32\u003e,\n    pub Subnets: Vec\u003cu32\u003e,\n    pub Groups: Vec\u003cString\u003e,\n    pub NotBefore: i64,\n    pub NotAfter: i64,\n    pub PublicKey: Vec\u003cu8\u003e,\n    pub IsCA: bool,\n    pub Issuer: Vec\u003cu8\u003e,\n}\n\nimpl\u003c'a\u003e MessageRead\u003c'a\u003e for RawNebulaCertificateDetails {\n    fn from_reader(r: \u0026mut BytesReader, bytes: \u0026'a [u8]) -\u003e Result\u003cSelf\u003e {\n        let mut msg = Self::default();\n        while !r.is_eof() {\n            match r.next_tag(bytes) {\n                Ok(10) =\u003e msg.Name = r.read_string(bytes)?.to_owned(),\n                Ok(18) =\u003e msg.Ips = r.read_packed(bytes, |r, bytes| Ok(r.read_uint32(bytes)?))?,\n                Ok(26) =\u003e msg.Subnets = r.read_packed(bytes, |r, bytes| Ok(r.read_uint32(bytes)?))?,\n                Ok(34) =\u003e msg.Groups.push(r.read_string(bytes)?.to_owned()),\n                Ok(40) =\u003e msg.NotBefore = r.read_int64(bytes)?,\n                Ok(48) =\u003e msg.NotAfter = r.read_int64(bytes)?,\n                Ok(58) =\u003e msg.PublicKey = r.read_bytes(bytes)?.to_owned(),\n                Ok(64) =\u003e msg.IsCA = r.read_bool(bytes)?,\n                Ok(74) =\u003e msg.Issuer = r.read_bytes(bytes)?.to_owned(),\n                Ok(t) =\u003e { r.read_unknown(bytes, t)?; }\n                Err(e) =\u003e return Err(e),\n            }\n        }\n        Ok(msg)\n    }\n}\n\nimpl MessageWrite for RawNebulaCertificateDetails {\n    fn get_size(\u0026self) -\u003e usize {\n        0\n        + if self.Name == String::default() { 0 } else { 1 + sizeof_len((\u0026self.Name).len()) }\n        + if self.Ips.is_empty() { 0 } else { 1 + sizeof_len(self.Ips.iter().map(|s| sizeof_varint(*(s) as u64)).sum::\u003cusize\u003e()) }\n        + if self.Subnets.is_empty() { 0 } else { 1 + sizeof_len(self.Subnets.iter().map(|s| sizeof_varint(*(s) as u64)).sum::\u003cusize\u003e()) }\n        + self.Groups.iter().map(|s| 1 + sizeof_len((s).len())).sum::\u003cusize\u003e()\n        + if self.NotBefore == 0i64 { 0 } else { 1 + sizeof_varint(*(\u0026self.NotBefore) as u64) }\n        + if self.NotAfter == 0i64 { 0 } else { 1 + sizeof_varint(*(\u0026self.NotAfter) as u64) }\n        + if self.PublicKey.is_empty() { 0 } else { 1 + sizeof_len((\u0026self.PublicKey).len()) }\n        + if self.IsCA == false { 0 } else { 1 + sizeof_varint(*(\u0026self.IsCA) as u64) }\n        + if self.Issuer.is_empty() { 0 } else { 1 + sizeof_len((\u0026self.Issuer).len()) }\n    }\n\n    fn write_message\u003cW: WriterBackend\u003e(\u0026self, w: \u0026mut Writer\u003cW\u003e) -\u003e Result\u003c()\u003e {\n        if self.Name != String::default() { w.write_with_tag(10, |w| w.write_string(\u0026**\u0026self.Name))?; }\n        w.write_packed_with_tag(18, \u0026self.Ips, |w, m| w.write_uint32(*m), \u0026|m| sizeof_varint(*(m) as u64))?;\n        w.write_packed_with_tag(26, \u0026self.Subnets, |w, m| w.write_uint32(*m), \u0026|m| sizeof_varint(*(m) as u64))?;\n        for s in \u0026self.Groups { w.write_with_tag(34, |w| w.write_string(\u0026**s))?; }\n        if self.NotBefore != 0i64 { w.write_with_tag(40, |w| w.write_int64(*\u0026self.NotBefore))?; }\n        if self.NotAfter != 0i64 { w.write_with_tag(48, |w| w.write_int64(*\u0026self.NotAfter))?; }\n        if !self.PublicKey.is_empty() { w.write_with_tag(58, |w| w.write_bytes(\u0026**\u0026self.PublicKey))?; }\n        if self.IsCA != false { w.write_with_tag(64, |w| w.write_bool(*\u0026self.IsCA))?; }\n        if !self.Issuer.is_empty() { w.write_with_tag(74, |w| w.write_bytes(\u0026**\u0026self.Issuer))?; }\n        Ok(())\n    }\n}\n\n","traces":[],"covered":0,"coverable":0},{"path":["/","home","core","prj","e3t","trifid","trifid-pki","src","lib.rs"],"content":"//! # trifid-pki\n//! trifid-pki is a crate for interacting with the Nebula PKI system. It was created to prevent the need to make constant CLI calls for signing operations in Nebula.\n//! It is designed to be interoperable with the original Go implementation and as such has some oddities with key management to ensure compatability.\n//!\n//! This crate has not received any format security audits, however the underlying crates used for actual cryptographic operations (ed25519-dalek and curve25519-dalek) have been audited with no major issues.\n\n#![warn(clippy::pedantic)]\n#![warn(clippy::nursery)]\n#![deny(clippy::unwrap_used)]\n#![deny(clippy::expect_used)]\n#![deny(missing_docs)]\n#![deny(clippy::missing_errors_doc)]\n#![deny(clippy::missing_panics_doc)]\n#![deny(clippy::missing_safety_doc)]\n#![allow(clippy::must_use_candidate)]\n#![allow(clippy::too_many_lines)]\n#![allow(clippy::module_name_repetitions)]\n\n\nextern crate core;\n\npub mod ca;\npub mod cert;\n#[cfg(not(tarpaulin_include))]\npub(crate) mod cert_codec;\n#[cfg(test)]\n#[macro_use]\npub mod test;","traces":[],"covered":0,"coverable":0},{"path":["/","home","core","prj","e3t","trifid","trifid-pki","src","test.rs"],"content":"#![allow(clippy::unwrap_used)]\n#![allow(clippy::expect_used)]\n\nuse crate::netmask;\nuse std::net::Ipv4Addr;\nuse std::ops::{Add, Sub};\nuse std::time::{Duration, SystemTime, SystemTimeError, UNIX_EPOCH};\nuse ipnet::Ipv4Net;\nuse crate::cert::{CertificateValidity, deserialize_ed25519_private, deserialize_ed25519_public, deserialize_nebula_certificate, deserialize_nebula_certificate_from_pem, deserialize_x25519_private, deserialize_x25519_public, NebulaCertificate, NebulaCertificateDetails, serialize_ed25519_private, serialize_ed25519_public, serialize_x25519_private, serialize_x25519_public};\nuse std::str::FromStr;\nuse ed25519_dalek::{SigningKey, VerifyingKey};\nuse quick_protobuf::{MessageWrite, Writer};\nuse rand::rngs::OsRng;\nuse crate::ca::{NebulaCAPool};\nuse crate::cert_codec::{RawNebulaCertificate, RawNebulaCertificateDetails};\n\n/// This is a cert that we (e3team) actually use in production, and it's a known-good certificate.\npub const KNOWN_GOOD_CERT: \u0026[u8; 258] = b\"-----BEGIN NEBULA CERTIFICATE-----\\nCkkKF2UzdGVhbSBJbnRlcm5hbCBOZXR3b3JrKJWev5wGMJWFxKsGOiCvpwoHyKY5\\n8Q5+2XxDjtoCf/zlNY/EUdB8bwXQSwEo50ABEkB0Dx76lkMqc3IyH5+ml2dKjTyv\\nB4Jiw6x3abf5YZcf8rDuVEgQpvFdJmo3xJyIb3C9vKZ6kXsUxjw6s1JdWgkA\\n-----END NEBULA CERTIFICATE-----\";\n\n#[test]\nfn certificate_serialization() {\n    let before = round_systime_to_secs(SystemTime::now() - Duration::from_secs(60)).unwrap();\n    let after = round_systime_to_secs(SystemTime::now() + Duration::from_secs(60)).unwrap();\n    let pub_key = b\"1234567890abcedfghij1234567890ab\";\n\n    let cert = NebulaCertificate {\n        details: NebulaCertificateDetails {\n            name: \"testing\".to_string(),\n            ips: vec![\n                netmask!(\"10.1.1.1\", \"255.255.255.0\"),\n                netmask!(\"10.1.1.2\", \"255.255.0.0\"),\n                netmask!(\"10.1.1.3\", \"255.0.0.0\")\n            ],\n            subnets: vec![\n                netmask!(\"9.1.1.1\", \"255.255.255.128\"),\n                netmask!(\"9.1.1.2\", \"255.255.255.0\"),\n                netmask!(\"9.1.1.3\", \"255.255.0.0\")\n            ],\n            groups: vec![\"test-group1\".to_string(), \"test-group2\".to_string(), \"test-group3\".to_string()],\n            not_before: before,\n            not_after: after,\n            public_key: *pub_key,\n            is_ca: false,\n            issuer: \"1234567890abcedfabcd1234567890ab\".to_string(),\n        },\n        signature: b\"1234567890abcedfghij1234567890ab\".to_vec(),\n    };\n\n    let bytes = cert.serialize().unwrap();\n\n    let deserialized = deserialize_nebula_certificate(\u0026bytes).unwrap();\n\n    assert_eq!(cert.signature, deserialized.signature);\n    assert_eq!(cert.details.name, deserialized.details.name);\n    assert_eq!(cert.details.not_before, deserialized.details.not_before);\n    assert_eq!(cert.details.not_after, deserialized.details.not_after);\n    assert_eq!(cert.details.public_key, deserialized.details.public_key);\n    assert_eq!(cert.details.is_ca, deserialized.details.is_ca);\n\n    assert_eq!(cert.details.ips.len(), deserialized.details.ips.len());\n    for item in \u0026cert.details.ips {\n        assert!(deserialized.details.ips.contains(item), \"deserialized does not contain from source\");\n    }\n\n    assert_eq!(cert.details.subnets.len(), deserialized.details.subnets.len());\n    for item in \u0026cert.details.subnets {\n        assert!(deserialized.details.subnets.contains(item), \"deserialized does not contain from source\");\n    }\n\n    assert_eq!(cert.details.groups.len(), deserialized.details.groups.len());\n    for item in \u0026cert.details.groups {\n        assert!(deserialized.details.groups.contains(item), \"deserialized does not contain from source\");\n    }\n}\n\n#[test]\nfn certificate_serialization_pem() {\n    let before = round_systime_to_secs(SystemTime::now() - Duration::from_secs(60)).unwrap();\n    let after = round_systime_to_secs(SystemTime::now() + Duration::from_secs(60)).unwrap();\n    let pub_key = b\"1234567890abcedfghij1234567890ab\";\n\n    let cert = NebulaCertificate {\n        details: NebulaCertificateDetails {\n            name: \"testing\".to_string(),\n            ips: vec![\n                netmask!(\"10.1.1.1\", \"255.255.255.0\"),\n                netmask!(\"10.1.1.2\", \"255.255.0.0\"),\n                netmask!(\"10.1.1.3\", \"255.0.0.0\")\n            ],\n            subnets: vec![\n                netmask!(\"9.1.1.1\", \"255.255.255.128\"),\n                netmask!(\"9.1.1.2\", \"255.255.255.0\"),\n                netmask!(\"9.1.1.3\", \"255.255.0.0\")\n            ],\n            groups: vec![\"test-group1\".to_string(), \"test-group2\".to_string(), \"test-group3\".to_string()],\n            not_before: before,\n            not_after: after,\n            public_key: *pub_key,\n            is_ca: false,\n            issuer: \"1234567890abcedfabcd1234567890ab\".to_string(),\n        },\n        signature: b\"1234567890abcedfghij1234567890ab\".to_vec(),\n    };\n\n    let bytes = cert.serialize_to_pem().unwrap();\n\n    let deserialized = deserialize_nebula_certificate_from_pem(\u0026bytes).unwrap();\n\n    assert_eq!(cert.signature, deserialized.signature);\n    assert_eq!(cert.details.name, deserialized.details.name);\n    assert_eq!(cert.details.not_before, deserialized.details.not_before);\n    assert_eq!(cert.details.not_after, deserialized.details.not_after);\n    assert_eq!(cert.details.public_key, deserialized.details.public_key);\n    assert_eq!(cert.details.is_ca, deserialized.details.is_ca);\n\n    assert_eq!(cert.details.ips.len(), deserialized.details.ips.len());\n    for item in \u0026cert.details.ips {\n        assert!(deserialized.details.ips.contains(item), \"deserialized does not contain from source\");\n    }\n\n    assert_eq!(cert.details.subnets.len(), deserialized.details.subnets.len());\n    for item in \u0026cert.details.subnets {\n        assert!(deserialized.details.subnets.contains(item), \"deserialized does not contain from source\");\n    }\n\n    assert_eq!(cert.details.groups.len(), deserialized.details.groups.len());\n    for item in \u0026cert.details.groups {\n        assert!(deserialized.details.groups.contains(item), \"deserialized does not contain from source\");\n    }\n}\n\n#[test]\nfn cert_signing() {\n    let before = round_systime_to_secs(SystemTime::now() - Duration::from_secs(60)).unwrap();\n    let after = round_systime_to_secs(SystemTime::now() + Duration::from_secs(60)).unwrap();\n    let pub_key = b\"1234567890abcedfghij1234567890ab\";\n\n    let mut cert = NebulaCertificate {\n        details: NebulaCertificateDetails {\n            name: \"testing\".to_string(),\n            ips: vec![\n                netmask!(\"10.1.1.1\", \"255.255.255.0\"),\n                netmask!(\"10.1.1.2\", \"255.255.0.0\"),\n                netmask!(\"10.1.1.3\", \"255.0.0.0\")\n            ],\n            subnets: vec![\n                netmask!(\"9.1.1.1\", \"255.255.255.128\"),\n                netmask!(\"9.1.1.2\", \"255.255.255.0\"),\n                netmask!(\"9.1.1.3\", \"255.255.0.0\")\n            ],\n            groups: vec![\"test-group1\".to_string(), \"test-group2\".to_string(), \"test-group3\".to_string()],\n            not_before: before,\n            not_after: after,\n            public_key: *pub_key,\n            is_ca: false,\n            issuer: \"1234567890abcedfabcd1234567890ab\".to_string(),\n        },\n        signature: b\"1234567890abcedfghij1234567890ab\".to_vec(),\n    };\n\n    let mut csprng = OsRng;\n    let key = SigningKey::generate(\u0026mut csprng);\n\n    assert!(cert.check_signature(\u0026key.verifying_key()).is_err());\n    cert.sign(\u0026key).unwrap();\n    assert!(cert.check_signature(\u0026key.verifying_key()).unwrap());\n}\n\n#[test]\nfn cert_expiry() {\n    let cert = NebulaCertificate {\n        details: NebulaCertificateDetails {\n            name: String::new(),\n            ips: vec![],\n            subnets: vec![],\n            groups: vec![],\n            not_before: SystemTime::now().sub(Duration::from_secs(60)),\n            not_after: SystemTime::now().add(Duration::from_secs(60)),\n            public_key: [0u8; 32],\n            is_ca: false,\n            issuer: String::new(),\n        },\n        signature: vec![],\n    };\n\n    assert!(cert.expired(SystemTime::now().add(Duration::from_secs(60 * 60 * 60))));\n    assert!(cert.expired(SystemTime::now().sub(Duration::from_secs(60 * 60 * 60))));\n    assert!(!cert.expired(SystemTime::now()));\n}\n\n#[test]\nfn cert_display() {\n    let cert = NebulaCertificate {\n        details: NebulaCertificateDetails {\n            name: String::new(),\n            ips: vec![],\n            subnets: vec![],\n            groups: vec![],\n            not_before: SystemTime::now().sub(Duration::from_secs(60)),\n            not_after: SystemTime::now().add(Duration::from_secs(60)),\n            public_key: [0u8; 32],\n            is_ca: false,\n            issuer: String::new(),\n        },\n        signature: vec![],\n    };\n    println!(\"{cert}\");\n}\n\n#[test]\n#[should_panic]\nfn cert_deserialize_empty_bytes() {\n    deserialize_nebula_certificate(\u0026[]).unwrap();\n}\n\n#[test]\nfn cert_deserialize_unpaired_ips() {\n    let broken_cert = RawNebulaCertificate {\n        Details: Some(RawNebulaCertificateDetails {\n            Name: String::new(),\n            Ips: vec![0],\n            Subnets: vec![],\n            Groups: vec![],\n            NotBefore: 0,\n            NotAfter: 0,\n            PublicKey: vec![],\n            IsCA: false,\n            Issuer: vec![],\n        }),\n        Signature: vec![],\n    };\n    let mut bytes = vec![];\n    let mut writer = Writer::new(\u0026mut bytes);\n    broken_cert.write_message(\u0026mut writer).unwrap();\n\n    deserialize_nebula_certificate(\u0026bytes).unwrap_err();\n}\n\n#[test]\nfn cert_deserialize_unpaired_subnets() {\n    let broken_cert = RawNebulaCertificate {\n        Details: Some(RawNebulaCertificateDetails {\n            Name: String::new(),\n            Ips: vec![],\n            Subnets: vec![0],\n            Groups: vec![],\n            NotBefore: 0,\n            NotAfter: 0,\n            PublicKey: vec![],\n            IsCA: false,\n            Issuer: vec![],\n        }),\n        Signature: vec![],\n    };\n    let mut bytes = vec![];\n    let mut writer = Writer::new(\u0026mut bytes);\n    broken_cert.write_message(\u0026mut writer).unwrap();\n\n    deserialize_nebula_certificate(\u0026bytes).unwrap_err();\n}\n\n#[test]\nfn cert_deserialize_wrong_pubkey_len() {\n    let broken_cert = RawNebulaCertificate {\n        Details: Some(RawNebulaCertificateDetails {\n            Name: String::new(),\n            Ips: vec![],\n            Subnets: vec![],\n            Groups: vec![],\n            NotBefore: 0,\n            NotAfter: 0,\n            PublicKey: vec![0u8; 31],\n            IsCA: false,\n            Issuer: vec![],\n        }),\n        Signature: vec![],\n    };\n    let mut bytes = vec![];\n    let mut writer = Writer::new(\u0026mut bytes);\n    broken_cert.write_message(\u0026mut writer).unwrap();\n\n    deserialize_nebula_certificate(\u0026bytes).unwrap_err();\n\n    assert!(deserialize_nebula_certificate_from_pem(\u0026[0u8; 32]).is_err());\n}\n\n#[test]\nfn x25519_serialization() {\n    let bytes = [0u8; 32];\n    assert_eq!(deserialize_x25519_private(\u0026serialize_x25519_private(\u0026bytes)).unwrap(), bytes);\n    assert!(deserialize_x25519_private(\u0026[0u8; 32]).is_err());\n    assert_eq!(deserialize_x25519_public(\u0026serialize_x25519_public(\u0026bytes)).unwrap(), bytes);\n    assert!(deserialize_x25519_public(\u0026[0u8; 32]).is_err());\n}\n\n#[test]\nfn ed25519_serialization() {\n    let bytes = [0u8; 32];\n    assert_eq!(deserialize_ed25519_private(\u0026serialize_ed25519_private(\u0026bytes)).unwrap(), bytes);\n    assert!(deserialize_ed25519_private(\u0026[0u8; 32]).is_err());\n    assert_eq!(deserialize_ed25519_public(\u0026serialize_ed25519_public(\u0026bytes)).unwrap(), bytes);\n    assert!(deserialize_ed25519_public(\u0026[0u8; 32]).is_err());\n}\n\n#[test]\nfn cert_verify() {\n    let (ca_cert, ca_key, _ca_pub) = test_ca_cert(round_systime_to_secs(SystemTime::now()).unwrap(), round_systime_to_secs(SystemTime::now() + Duration::from_secs(60 * 60 * 10)).unwrap(), vec![], vec![], vec![\"groupa\".to_string()]);\n\n    let (cert, _, _) = test_cert(\u0026ca_cert, \u0026ca_key, SystemTime::now(), round_systime_to_secs(SystemTime::now() + Duration::from_secs(60 * 60 * 5)).unwrap(), vec![], vec![], vec![]);\n\n    let mut ca_pool = NebulaCAPool::new();\n    ca_pool.add_ca_certificate(\u0026ca_cert.serialize_to_pem().unwrap()).unwrap();\n\n    let fingerprint = cert.sha256sum().unwrap();\n    ca_pool.blocklist_fingerprint(\u0026fingerprint);\n\n    assert!(matches!(cert.verify(SystemTime::now(), \u0026ca_pool).unwrap(), CertificateValidity::Blocklisted));\n\n    ca_pool.reset_blocklist();\n\n    assert!(matches!(cert.verify(SystemTime::now() + Duration::from_secs(60 * 60 * 60), \u0026ca_pool).unwrap(), CertificateValidity::RootCertExpired));\n    assert!(matches!(cert.verify(SystemTime::now() + Duration::from_secs(60 * 60 * 6), \u0026ca_pool).unwrap(), CertificateValidity::CertExpired));\n\n    let (cert_with_bad_group, _, _) = test_cert(\u0026ca_cert, \u0026ca_key, round_systime_to_secs(SystemTime::now()).unwrap(), in_a_minute(), vec![], vec![], vec![\"group-not-present on parent\".to_string()]);\n    assert_eq!(cert_with_bad_group.verify(SystemTime::now(), \u0026ca_pool).unwrap(), CertificateValidity::GroupNotPresentOnSigner);\n\n    let (cert_with_good_group, _, _) = test_cert(\u0026ca_cert, \u0026ca_key, round_systime_to_secs(SystemTime::now()).unwrap(), in_a_minute(), vec![], vec![], vec![\"groupa\".to_string()]);\n    assert_eq!(cert_with_good_group.verify(SystemTime::now(), \u0026ca_pool).unwrap(), CertificateValidity::Ok);\n\n}\n\n#[test]\nfn cert_verify_ip() {\n    let ca_ip_1 = Ipv4Net::from_str(\"10.0.0.0/16\").unwrap();\n    let ca_ip_2 = Ipv4Net::from_str(\"192.168.0.0/24\").unwrap();\n\n    let (ca, ca_key, _ca_pub) = test_ca_cert(round_systime_to_secs(SystemTime::now()).unwrap(), round_systime_to_secs(SystemTime::now() + Duration::from_secs(60 * 60 * 10)).unwrap(), vec![ca_ip_1, ca_ip_2], vec![], vec![]);\n\n    let ca_pem = ca.serialize_to_pem().unwrap();\n\n    let mut ca_pool = NebulaCAPool::new();\n    ca_pool.add_ca_certificate(\u0026ca_pem).unwrap();\n\n    // ip is outside the network\n    let cip1 = netmask!(\"10.1.0.0\", \"255.255.255.0\");\n    let cip2 = netmask!(\"192.198.0.1\", \"255.255.0.0\");\n    let (cert, _, _) = test_cert(\u0026ca, \u0026ca_key, round_systime_to_secs(SystemTime::now()).unwrap(), round_systime_to_secs(SystemTime::now() + Duration::from_secs(60 * 60 * 5)).unwrap(), vec![cip1, cip2], vec![], vec![]);\n\n    assert_eq!(cert.verify(SystemTime::now(), \u0026ca_pool).unwrap(), CertificateValidity::IPNotPresentOnSigner);\n\n    // ip is outside the network - reversed order from above\n    let cip1 = netmask!(\"192.198.0.1\", \"255.255.255.0\");\n    let cip2 = netmask!(\"10.1.0.0\", \"255.255.255.0\");\n    let (cert, _, _) = test_cert(\u0026ca, \u0026ca_key, round_systime_to_secs(SystemTime::now()).unwrap(), round_systime_to_secs(SystemTime::now() + Duration::from_secs(60 * 60 * 5)).unwrap(), vec![cip1, cip2], vec![], vec![]);\n\n    assert_eq!(cert.verify(SystemTime::now(), \u0026ca_pool).unwrap(), CertificateValidity::IPNotPresentOnSigner);\n\n    // ip is within the network but mask is outside\n    let cip1 = netmask!(\"10.0.1.0\", \"255.254.0.0\");\n    let cip2 = netmask!(\"192.168.0.1\", \"255.255.255.0\");\n    let (cert, _, _) = test_cert(\u0026ca, \u0026ca_key, round_systime_to_secs(SystemTime::now()).unwrap(), round_systime_to_secs(SystemTime::now() + Duration::from_secs(60 * 60 * 5)).unwrap(), vec![cip1, cip2], vec![], vec![]);\n\n    assert_eq!(cert.verify(SystemTime::now(), \u0026ca_pool).unwrap(), CertificateValidity::IPNotPresentOnSigner);\n\n    // ip is within the network but mask is outside - reversed order from above\n    let cip1 = netmask!(\"192.168.0.1\", \"255.255.255.0\");\n    let cip2 = netmask!(\"10.0.1.0\", \"255.254.0.0\");\n    let (cert, _, _) = test_cert(\u0026ca, \u0026ca_key, round_systime_to_secs(SystemTime::now()).unwrap(), round_systime_to_secs(SystemTime::now() + Duration::from_secs(60 * 60 * 5)).unwrap(), vec![cip1, cip2], vec![], vec![]);\n\n    assert_eq!(cert.verify(SystemTime::now(), \u0026ca_pool).unwrap(), CertificateValidity::IPNotPresentOnSigner);\n\n    // ip and mask are within the network\n    let cip1 = netmask!(\"10.0.1.0\", \"255.255.0.0\");\n    let cip2 = netmask!(\"192.168.0.1\", \"255.255.255.128\");\n    let (cert, _, _) = test_cert(\u0026ca, \u0026ca_key, round_systime_to_secs(SystemTime::now()).unwrap(), round_systime_to_secs(SystemTime::now() + Duration::from_secs(60 * 60 * 5)).unwrap(), vec![cip1, cip2], vec![], vec![]);\n\n    assert_eq!(cert.verify(SystemTime::now(), \u0026ca_pool).unwrap(), CertificateValidity::Ok);\n\n    // Exact matches\n    let (cert, _, _) = test_cert(\u0026ca, \u0026ca_key, round_systime_to_secs(SystemTime::now()).unwrap(), round_systime_to_secs(SystemTime::now() + Duration::from_secs(60 * 60 * 5)).unwrap(), vec![ca_ip_1, ca_ip_2], vec![], vec![]);\n    assert_eq!(cert.verify(SystemTime::now(), \u0026ca_pool).unwrap(), CertificateValidity::Ok);\n\n    // Exact matches reversed\n    let (cert, _, _) = test_cert(\u0026ca, \u0026ca_key, round_systime_to_secs(SystemTime::now()).unwrap(), round_systime_to_secs(SystemTime::now() + Duration::from_secs(60 * 60 * 5)).unwrap(), vec![ca_ip_2, ca_ip_1], vec![], vec![]);\n    assert_eq!(cert.verify(SystemTime::now(), \u0026ca_pool).unwrap(), CertificateValidity::Ok);\n\n    // Exact matches reversed with just one\n    let (cert, _, _) = test_cert(\u0026ca, \u0026ca_key, round_systime_to_secs(SystemTime::now()).unwrap(), round_systime_to_secs(SystemTime::now() + Duration::from_secs(60 * 60 * 5)).unwrap(), vec![ca_ip_2], vec![], vec![]);\n    assert_eq!(cert.verify(SystemTime::now(), \u0026ca_pool).unwrap(), CertificateValidity::Ok);\n}\n\n#[test]\nfn cert_verify_subnet() {\n    let ca_ip_1 = Ipv4Net::from_str(\"10.0.0.0/16\").unwrap();\n    let ca_ip_2 = Ipv4Net::from_str(\"192.168.0.0/24\").unwrap();\n\n    let (ca, ca_key, _ca_pub) = test_ca_cert(round_systime_to_secs(SystemTime::now()).unwrap(), round_systime_to_secs(SystemTime::now() + Duration::from_secs(60 * 60 * 10)).unwrap(), vec![],vec![ca_ip_1, ca_ip_2], vec![]);\n\n    let ca_pem = ca.serialize_to_pem().unwrap();\n\n    let mut ca_pool = NebulaCAPool::new();\n    ca_pool.add_ca_certificate(\u0026ca_pem).unwrap();\n\n    // ip is outside the network\n    let cip1 = netmask!(\"10.1.0.0\", \"255.255.255.0\");\n    let cip2 = netmask!(\"192.198.0.1\", \"255.255.0.0\");\n    let (cert, _, _) = test_cert(\u0026ca, \u0026ca_key, round_systime_to_secs(SystemTime::now()).unwrap(), round_systime_to_secs(SystemTime::now() + Duration::from_secs(60 * 60 * 5)).unwrap(), vec![],vec![cip1, cip2], vec![]);\n\n    assert_eq!(cert.verify(SystemTime::now(), \u0026ca_pool).unwrap(), CertificateValidity::SubnetNotPresentOnSigner);\n\n    // ip is outside the network - reversed order from above\n    let cip1 = netmask!(\"192.198.0.1\", \"255.255.255.0\");\n    let cip2 = netmask!(\"10.1.0.0\", \"255.255.255.0\");\n    let (cert, _, _) = test_cert(\u0026ca, \u0026ca_key, round_systime_to_secs(SystemTime::now()).unwrap(), round_systime_to_secs(SystemTime::now() + Duration::from_secs(60 * 60 * 5)).unwrap(), vec![],vec![cip1, cip2], vec![]);\n\n    assert_eq!(cert.verify(SystemTime::now(), \u0026ca_pool).unwrap(), CertificateValidity::SubnetNotPresentOnSigner);\n\n    // ip is within the network but mask is outside\n    let cip1 = netmask!(\"10.0.1.0\", \"255.254.0.0\");\n    let cip2 = netmask!(\"192.168.0.1\", \"255.255.255.0\");\n    let (cert, _, _) = test_cert(\u0026ca, \u0026ca_key, round_systime_to_secs(SystemTime::now()).unwrap(), round_systime_to_secs(SystemTime::now() + Duration::from_secs(60 * 60 * 5)).unwrap(), vec![],vec![cip1, cip2], vec![]);\n\n    assert_eq!(cert.verify(SystemTime::now(), \u0026ca_pool).unwrap(), CertificateValidity::SubnetNotPresentOnSigner);\n\n    // ip is within the network but mask is outside - reversed order from above\n    let cip1 = netmask!(\"192.168.0.1\", \"255.255.255.0\");\n    let cip2 = netmask!(\"10.0.1.0\", \"255.254.0.0\");\n    let (cert, _, _) = test_cert(\u0026ca, \u0026ca_key, round_systime_to_secs(SystemTime::now()).unwrap(), round_systime_to_secs(SystemTime::now() + Duration::from_secs(60 * 60 * 5)).unwrap(), vec![cip1, cip2], vec![], vec![]);\n\n    assert_eq!(cert.verify(SystemTime::now(), \u0026ca_pool).unwrap(), CertificateValidity::SubnetNotPresentOnSigner);\n\n    // ip and mask are within the network\n    let cip1 = netmask!(\"10.0.1.0\", \"255.255.0.0\");\n    let cip2 = netmask!(\"192.168.0.1\", \"255.255.255.128\");\n    let (cert, _, _) = test_cert(\u0026ca, \u0026ca_key, round_systime_to_secs(SystemTime::now()).unwrap(), round_systime_to_secs(SystemTime::now() + Duration::from_secs(60 * 60 * 5)).unwrap(), vec![], vec![cip1, cip2], vec![]);\n\n    assert_eq!(cert.verify(SystemTime::now(), \u0026ca_pool).unwrap(), CertificateValidity::Ok);\n\n    // Exact matches\n    let (cert, _, _) = test_cert(\u0026ca, \u0026ca_key, round_systime_to_secs(SystemTime::now()).unwrap(), round_systime_to_secs(SystemTime::now() + Duration::from_secs(60 * 60 * 5)).unwrap(), vec![],vec![ca_ip_1, ca_ip_2], vec![]);\n    assert_eq!(cert.verify(SystemTime::now(), \u0026ca_pool).unwrap(), CertificateValidity::Ok);\n\n    // Exact matches reversed\n    let (cert, _, _) = test_cert(\u0026ca, \u0026ca_key, round_systime_to_secs(SystemTime::now()).unwrap(), round_systime_to_secs(SystemTime::now() + Duration::from_secs(60 * 60 * 5)).unwrap(), vec![], vec![ca_ip_2, ca_ip_1], vec![]);\n    assert_eq!(cert.verify(SystemTime::now(), \u0026ca_pool).unwrap(), CertificateValidity::Ok);\n\n    // Exact matches reversed with just one\n    let (cert, _, _) = test_cert(\u0026ca, \u0026ca_key, round_systime_to_secs(SystemTime::now()).unwrap(), round_systime_to_secs(SystemTime::now() + Duration::from_secs(60 * 60 * 5)).unwrap(), vec![], vec![ca_ip_2], vec![]);\n    assert_eq!(cert.verify(SystemTime::now(), \u0026ca_pool).unwrap(), CertificateValidity::Ok);\n}\n\n#[test]\nfn cert_private_key() {\n    let (ca, ca_key, _) = test_ca_cert(SystemTime::now(), SystemTime::now(), vec![], vec![], vec![]);\n    ca.verify_private_key(\u0026ca_key.to_keypair_bytes()).unwrap();\n\n    let (_, ca_key2, _) = test_ca_cert(SystemTime::now(), SystemTime::now(), vec![], vec![], vec![]);\n    ca.verify_private_key(\u0026ca_key2.to_keypair_bytes()).unwrap_err();\n\n    let (cert, priv_key, _) = test_cert(\u0026ca, \u0026ca_key, SystemTime::now(), SystemTime::now(), vec![], vec![], vec![]);\n    cert.verify_private_key(\u0026priv_key.to_bytes()).unwrap();\n\n    let (cert2, _, _) = test_cert(\u0026ca, \u0026ca_key, SystemTime::now(), SystemTime::now(), vec![], vec![], vec![]);\n    cert2.verify_private_key(\u0026priv_key.to_bytes()).unwrap_err();\n}\n\n#[test]\nfn capool_from_pem() {\n    let no_newlines = b\"# Current provisional, Remove once everything moves over to the real root.\n-----BEGIN NEBULA CERTIFICATE-----\nCkAKDm5lYnVsYSByb290IGNhKJfap9AFMJfg1+YGOiCUQGByMuNRhIlQBOyzXWbL\nvcKBwDhov900phEfJ5DN3kABEkDCq5R8qBiu8sl54yVfgRcQXEDt3cHr8UTSLszv\nbzBEr00kERQxxTzTsH8cpYEgRoipvmExvg8WP8NdAJEYJosB\n-----END NEBULA CERTIFICATE-----\n# root-ca01\n-----BEGIN NEBULA CERTIFICATE-----\nCkMKEW5lYnVsYSByb290IGNhIDAxKJL2u9EFMJL86+cGOiDPXMH4oU6HZTk/CqTG\nBVG+oJpAoqokUBbI4U0N8CSfpUABEkB/Pm5A2xyH/nc8mg/wvGUWG3pZ7nHzaDMf\n8/phAUt+FLzqTECzQKisYswKvE3pl9mbEYKbOdIHrxdIp95mo4sF\n-----END NEBULA CERTIFICATE-----\";\n    let with_newlines = b\"# Current provisional, Remove once everything moves over to the real root.\n-----BEGIN NEBULA CERTIFICATE-----\nCkAKDm5lYnVsYSByb290IGNhKJfap9AFMJfg1+YGOiCUQGByMuNRhIlQBOyzXWbL\nvcKBwDhov900phEfJ5DN3kABEkDCq5R8qBiu8sl54yVfgRcQXEDt3cHr8UTSLszv\nbzBEr00kERQxxTzTsH8cpYEgRoipvmExvg8WP8NdAJEYJosB\n-----END NEBULA CERTIFICATE-----\n# root-ca01\n-----BEGIN NEBULA CERTIFICATE-----\nCkMKEW5lYnVsYSByb290IGNhIDAxKJL2u9EFMJL86+cGOiDPXMH4oU6HZTk/CqTG\nBVG+oJpAoqokUBbI4U0N8CSfpUABEkB/Pm5A2xyH/nc8mg/wvGUWG3pZ7nHzaDMf\n8/phAUt+FLzqTECzQKisYswKvE3pl9mbEYKbOdIHrxdIp95mo4sF\n-----END NEBULA CERTIFICATE-----\n\n\";\n    let expired = b\"# expired certificate\n-----BEGIN NEBULA CERTIFICATE-----\nCjkKB2V4cGlyZWQouPmWjQYwufmWjQY6ILCRaoCkJlqHgv5jfDN4lzLHBvDzaQm4\nvZxfu144hmgjQAESQG4qlnZi8DncvD/LDZnLgJHOaX1DWCHHEh59epVsC+BNgTie\nWH1M9n4O7cFtGlM6sJJOS+rCVVEJ3ABS7+MPdQs=\n-----END NEBULA CERTIFICATE-----\";\n\n    let pool_a = NebulaCAPool::new_from_pem(no_newlines).unwrap();\n    assert_eq!(pool_a.cas[\"c9bfaf7ce8e84b2eeda2e27b469f4b9617bde192efd214b68891ecda6ed49522\"].details.name, \"nebula root ca\".to_string());\n    assert_eq!(pool_a.cas[\"5c9c3f23e7ee7fe97637cbd3a0a5b854154d1d9aaaf7b566a51f4a88f76b64cd\"].details.name, \"nebula root ca 01\".to_string());\n    assert!(!pool_a.expired);\n\n    let pool_b = NebulaCAPool::new_from_pem(with_newlines).unwrap();\n    assert_eq!(pool_b.cas[\"c9bfaf7ce8e84b2eeda2e27b469f4b9617bde192efd214b68891ecda6ed49522\"].details.name, \"nebula root ca\".to_string());\n    assert_eq!(pool_b.cas[\"5c9c3f23e7ee7fe97637cbd3a0a5b854154d1d9aaaf7b566a51f4a88f76b64cd\"].details.name, \"nebula root ca 01\".to_string());\n    assert!(!pool_b.expired);\n\n    let pool_c = NebulaCAPool::new_from_pem(expired).unwrap();\n    assert!(pool_c.expired);\n    assert_eq!(pool_c.cas[\"152070be6bb19bc9e3bde4c2f0e7d8f4ff5448b4c9856b8eccb314fade0229b0\"].details.name, \"expired\");\n\n    let mut pool_d = NebulaCAPool::new_from_pem(with_newlines).unwrap();\n    pool_d.add_ca_certificate(expired).unwrap();\n    assert_eq!(pool_d.cas[\"c9bfaf7ce8e84b2eeda2e27b469f4b9617bde192efd214b68891ecda6ed49522\"].details.name, \"nebula root ca\".to_string());\n    assert_eq!(pool_d.cas[\"5c9c3f23e7ee7fe97637cbd3a0a5b854154d1d9aaaf7b566a51f4a88f76b64cd\"].details.name, \"nebula root ca 01\".to_string());\n    assert_eq!(pool_d.cas[\"152070be6bb19bc9e3bde4c2f0e7d8f4ff5448b4c9856b8eccb314fade0229b0\"].details.name, \"expired\");\n    assert!(pool_d.expired);\n    assert_eq!(pool_d.get_fingerprints().len(), 3);\n}\n\n#[macro_export]\nmacro_rules! netmask {\n    ($ip:expr,$mask:expr) =\u003e {\n        Ipv4Net::with_netmask(Ipv4Addr::from_str($ip).unwrap(), Ipv4Addr::from_str($mask).unwrap()).unwrap()\n    };\n}\n\nfn round_systime_to_secs(time: SystemTime) -\u003e Result\u003cSystemTime, SystemTimeError\u003e {\n    let secs = time.duration_since(UNIX_EPOCH)?.as_secs();\n    Ok(SystemTime::UNIX_EPOCH.add(Duration::from_secs(secs)))\n}\n\nfn test_ca_cert(before: SystemTime, after: SystemTime, ips: Vec\u003cIpv4Net\u003e, subnets: Vec\u003cIpv4Net\u003e, groups: Vec\u003cString\u003e) -\u003e (NebulaCertificate, SigningKey, VerifyingKey) {\n    let mut csprng = OsRng;\n    let key = SigningKey::generate(\u0026mut csprng);\n    let pub_key = key.verifying_key();\n\n    let mut cert = NebulaCertificate {\n        details: NebulaCertificateDetails {\n            name: \"TEST_CA\".to_string(),\n            ips,\n            subnets,\n            groups,\n            not_before: before,\n            not_after: after,\n            public_key: pub_key.to_bytes(),\n            is_ca: true,\n            issuer: \"\".to_string(),\n        },\n        signature: vec![],\n    };\n    cert.sign(\u0026key).unwrap();\n    (cert, key, pub_key)\n}\n\nfn test_cert(ca: \u0026NebulaCertificate, key: \u0026SigningKey, before: SystemTime, after: SystemTime, ips: Vec\u003cIpv4Net\u003e, subnets: Vec\u003cIpv4Net\u003e, groups: Vec\u003cString\u003e) -\u003e (NebulaCertificate, SigningKey, VerifyingKey) {\n    let issuer = ca.sha256sum().unwrap();\n\n    let real_groups = if groups.is_empty() {\n        vec![\"test-group1\".to_string(), \"test-group2\".to_string(), \"test-group3\".to_string()]\n    } else {\n        groups\n    };\n\n    let real_ips = if ips.is_empty() {\n        vec![\n            netmask!(\"10.1.1.1\", \"255.255.255.0\"),\n            netmask!(\"10.1.1.2\", \"255.255.0.0\"),\n            netmask!(\"10.1.1.3\", \"255.0.0.0\")\n        ]\n    } else {\n        ips\n    };\n\n    let real_subnets = if subnets.is_empty() {\n        vec![\n            netmask!(\"9.1.1.1\", \"255.255.255.128\"),\n            netmask!(\"9.1.1.2\", \"255.255.255.0\"),\n            netmask!(\"9.1.1.3\", \"255.255.0.0\")\n        ]\n    } else {\n        subnets\n    };\n\n    let mut csprng = OsRng;\n    let cert_key = SigningKey::generate(\u0026mut csprng);\n    let pub_key = cert_key.verifying_key();\n\n    let mut cert = NebulaCertificate {\n        details: NebulaCertificateDetails {\n            name: \"TEST_CA\".to_string(),\n            ips: real_ips,\n            subnets: real_subnets,\n            groups: real_groups,\n            not_before: before,\n            not_after: after,\n            public_key: pub_key.to_bytes(),\n            is_ca: false,\n            issuer,\n        },\n        signature: vec![],\n    };\n    cert.sign(key).unwrap();\n    (cert, cert_key, pub_key)\n}\n\n#[allow(dead_code)]\nfn in_a_minute() -\u003e SystemTime {\n    round_systime_to_secs(SystemTime::now().add(Duration::from_secs(60))).unwrap()\n}\n#[allow(dead_code)]\nfn a_minute_ago() -\u003e SystemTime {\n    round_systime_to_secs(SystemTime::now().sub(Duration::from_secs(60))).unwrap()\n}","traces":[],"covered":0,"coverable":0}]};
+        var previousData = {"files":[{"path":["/","home","core","prj","e3t","trifid","tfclient","src","main.rs"],"content":"fn main() {\n    println!(\"Hello, world!\");\n}\n","traces":[],"covered":0,"coverable":0},{"path":["/","home","core","prj","e3t","trifid","trifid-api","build.rs"],"content":"// generated by `sqlx migrate build-script`\nfn main() {\n    // trigger recompilation when a new migration is added\n    println!(\"cargo:rerun-if-changed=migrations\");\n}","traces":[],"covered":0,"coverable":0},{"path":["/","home","core","prj","e3t","trifid","trifid-api","src","auth.rs"],"content":"use rocket::http::Status;\nuse rocket::{Request};\nuse rocket::request::{FromRequest, Outcome};\nuse crate::tokens::{validate_auth_token, validate_session_token};\n\npub struct PartialUserInfo {\n    pub user_id: i32,\n    pub created_at: i64,\n    pub email: String,\n    pub has_totp_auth: bool,\n\n    pub session_id: String,\n    pub auth_id: Option\u003cString\u003e\n}\n\n#[derive(Debug)]\npub enum AuthenticationError {\n    MissingToken,\n    InvalidToken(usize),\n    DatabaseError,\n    RequiresTOTP\n}\n\n#[rocket::async_trait]\nimpl\u003c'r\u003e FromRequest\u003c'r\u003e for PartialUserInfo {\n    type Error = AuthenticationError;\n\n    async fn from_request(req: \u0026'r Request\u003c'_\u003e) -\u003e Outcome\u003cSelf, Self::Error\u003e {\n        let headers = req.headers();\n\n        // make sure the bearer token exists\n        if let Some(authorization) = headers.get_one(\"Authorization\") {\n            // parse bearer token\n            let components = authorization.split(' ').collect::\u003cVec\u003c\u0026str\u003e\u003e();\n\n            if components.len() != 2 \u0026\u0026 components.len() != 3 {\n                return Outcome::Failure((Status::Unauthorized, AuthenticationError::MissingToken));\n            }\n\n            if components[0] != \"Bearer\" {\n                return Outcome::Failure((Status::Unauthorized, AuthenticationError::InvalidToken(0)));\n            }\n\n            if components.len() == 2 \u0026\u0026 !components[1].starts_with(\"st-\") {\n                return Outcome::Failure((Status::Unauthorized, AuthenticationError::InvalidToken(1)));\n            }\n\n            let st: String;\n            let user_id: i64;\n            let at: Option\u003cString\u003e;\n\n            match \u0026components[1][..3] {\n                \"st-\" =\u003e {\n                    // validate session token\n                    st = components[1].to_string();\n                    match validate_session_token(st.clone(), req.rocket().state().unwrap()).await {\n                        Ok(uid) =\u003e user_id = uid,\n                        Err(_) =\u003e return Outcome::Failure((Status::Unauthorized, AuthenticationError::InvalidToken(2)))\n                    }\n                },\n                _ =\u003e return Outcome::Failure((Status::Unauthorized, AuthenticationError::InvalidToken(3)))\n            }\n\n            if components.len() == 3 {\n                match \u0026components[2][..3] {\n                    \"at-\" =\u003e {\n                        // validate auth token\n                        at = Some(components[2].to_string());\n                        match validate_auth_token(at.clone().unwrap().clone(), st.clone(), req.rocket().state().unwrap()).await {\n                            Ok(_) =\u003e (),\n                            Err(_) =\u003e return Outcome::Failure((Status::Unauthorized, AuthenticationError::InvalidToken(4)))\n                        }\n                    },\n                    _ =\u003e return Outcome::Failure((Status::Unauthorized, AuthenticationError::InvalidToken(5)))\n                }\n            } else {\n                at = None;\n            }\n\n            // this user is 100% valid and authenticated, fetch their info\n\n            let user = match sqlx::query!(\"SELECT * FROM users WHERE id = $1\", user_id.clone() as i32).fetch_one(req.rocket().state().unwrap()).await {\n                Ok(u) =\u003e u,\n                Err(_) =\u003e return Outcome::Failure((Status::InternalServerError, AuthenticationError::DatabaseError))\n            };\n\n            Outcome::Success(PartialUserInfo {\n                user_id: user_id as i32,\n                created_at: user.created_on as i64,\n                email: user.email,\n                has_totp_auth: at.is_some(),\n                session_id: st,\n                auth_id: at,\n            })\n        } else {\n            Outcome::Failure((Status::Unauthorized, AuthenticationError::MissingToken))\n        }\n    }\n}\n\npub struct TOTPAuthenticatedUserInfo {\n    pub user_id: i32,\n    pub created_at: i64,\n    pub email: String,\n}\n#[rocket::async_trait]\nimpl\u003c'r\u003e FromRequest\u003c'r\u003e for TOTPAuthenticatedUserInfo {\n    type Error = AuthenticationError;\n\n    async fn from_request(request: \u0026'r Request\u003c'_\u003e) -\u003e Outcome\u003cSelf, Self::Error\u003e {\n        let userinfo = PartialUserInfo::from_request(request).await;\n        match userinfo {\n            Outcome::Failure(e) =\u003e Outcome::Failure(e),\n            Outcome::Forward(f) =\u003e Outcome::Forward(f),\n            Outcome::Success(s) =\u003e {\n                if s.has_totp_auth {\n                    Outcome::Success(Self {\n                        user_id: s.user_id,\n                        created_at: s.created_at,\n                        email: s.email,\n                    })\n                } else {\n                    Outcome::Failure((Status::Unauthorized, AuthenticationError::RequiresTOTP))\n                }\n            }\n        }\n    }\n}","traces":[{"line":28,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":29,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":32,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":34,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":36,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":37,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":40,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":41,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":44,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":45,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":48,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":49,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":50,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":52,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":53,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":55,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":56,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":57,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":58,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":61,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":64,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":65,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":66,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":68,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":69,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":70,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":71,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":74,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":77,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":82,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":83,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":84,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":87,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":88,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":89,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":90,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":91,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":92,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":93,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":96,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":110,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":111,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":112,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":113,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":114,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":115,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":116,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":117,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":118,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":119,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":120,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":123,"address":[],"length":0,"stats":{"Line":0},"fn_name":null}],"covered":0,"coverable":52},{"path":["/","home","core","prj","e3t","trifid","trifid-api","src","config.rs"],"content":"use serde::Deserialize;\nuse url::Url;\n\n#[derive(Deserialize)]\npub struct TFConfig {\n    pub listen_port: u16,\n    pub db_url: String,\n    pub base: Url,\n    pub web_root: Url,\n    pub magic_links_valid_for: i64,\n    pub session_tokens_valid_for: i64,\n    pub totp_verification_valid_for: i64,\n    pub data_key: String\n}","traces":[],"covered":0,"coverable":0},{"path":["/","home","core","prj","e3t","trifid","trifid-api","src","crypto.rs"],"content":"use std::error::Error;\nuse aes_gcm::{Aes256Gcm, KeyInit, Nonce};\nuse aes_gcm::aead::{Aead, Payload};\nuse crate::config::TFConfig;\n\npub fn get_cipher_from_config(config: \u0026TFConfig) -\u003e Result\u003cAes256Gcm, Box\u003cdyn Error\u003e\u003e {\n    let key_slice = hex::decode(\u0026config.data_key)?;\n    Ok(Aes256Gcm::new_from_slice(\u0026key_slice)?)\n}\n\npub fn encrypt_with_nonce(plaintext: \u0026[u8], nonce: [u8; 12], cipher: \u0026Aes256Gcm) -\u003e Result\u003cVec\u003cu8\u003e, aes_gcm::Error\u003e {\n    let nonce = Nonce::from_slice(\u0026nonce);\n    let ciphertext = cipher.encrypt(nonce, plaintext)?;\n    Ok(ciphertext)\n}\n\npub fn decrypt_with_nonce(ciphertext: \u0026[u8], nonce: [u8; 12], cipher: \u0026Aes256Gcm) -\u003e Result\u003cVec\u003cu8\u003e, aes_gcm::Error\u003e {\n    let nonce = Nonce::from_slice(\u0026nonce);\n    let plaintext = cipher.decrypt(nonce, Payload::from(ciphertext))?;\n    Ok(plaintext)\n}","traces":[],"covered":0,"coverable":0},{"path":["/","home","core","prj","e3t","trifid","trifid-api","src","db.rs"],"content":"","traces":[],"covered":0,"coverable":0},{"path":["/","home","core","prj","e3t","trifid","trifid-api","src","format.rs"],"content":"use std::fmt::{Display, Formatter};\nuse crate::format::PEMValidationError::{IncorrectSegmentLength, InvalidBase64Data, MissingStartSentinel};\nuse crate::util::base64decode;\n\npub const ED_PUBKEY_START_STR: \u0026str = \"-----BEGIN NEBULA ED25519 PUBLIC KEY-----\";\npub const ED_PUBKEY_END_STR: \u0026str = \"-----END NEBULA ED25519 PUBLIC KEY-----\";\n\npub const DH_PUBKEY_START_STR: \u0026str = \"-----BEGIN NEBULA X25519 PUBLIC KEY-----\";\npub const DH_PUBKEY_END_STR: \u0026str = \"-----END NEBULA X25519 PUBLIC KEY-----\";\n\npub enum PEMValidationError {\n    MissingStartSentinel,\n    InvalidBase64Data,\n    MissingEndSentinel,\n    IncorrectSegmentLength(usize, usize)\n}\nimpl Display for PEMValidationError {\n    fn fmt(\u0026self, f: \u0026mut Formatter\u003c'_\u003e) -\u003e std::fmt::Result {\n        match self {\n            Self::MissingEndSentinel =\u003e write!(f, \"Missing ending sentinel\"),\n            Self::MissingStartSentinel =\u003e write!(f, \"Missing starting sentinel\"),\n            Self::InvalidBase64Data =\u003e write!(f, \"invalid base64 data\"),\n            Self::IncorrectSegmentLength(expected, got) =\u003e write!(f, \"incorrect number of segments, expected {} got {}\", expected, got)\n        }\n    }\n}\n\npub fn validate_ed_pubkey_pem(pubkey: \u0026str) -\u003e Result\u003c(), PEMValidationError\u003e {\n    let segments = pubkey.split('\\n');\n    let segs = segments.collect::\u003cVec\u003c\u0026str\u003e\u003e();\n    if segs.len() \u003c 3 {\n        return Err(IncorrectSegmentLength(3, segs.len()))\n    }\n    if segs[0] != ED_PUBKEY_START_STR {\n        return Err(MissingStartSentinel)\n    }\n    if base64decode(segs[1]).is_err() {\n        return Err(InvalidBase64Data)\n    }\n    if segs[2] != ED_PUBKEY_END_STR {\n        return Err(MissingStartSentinel)\n    }\n    Ok(())\n}\n\npub fn validate_dh_pubkey_pem(pubkey: \u0026str) -\u003e Result\u003c(), PEMValidationError\u003e {\n    let segments = pubkey.split('\\n');\n    let segs = segments.collect::\u003cVec\u003c\u0026str\u003e\u003e();\n    if segs.len() \u003c 3 {\n        return Err(IncorrectSegmentLength(3, segs.len()))\n    }\n    if segs[0] != DH_PUBKEY_START_STR {\n        return Err(MissingStartSentinel)\n    }\n    if base64decode(segs[1]).is_err() {\n        return Err(InvalidBase64Data)\n    }\n    if segs[2] != DH_PUBKEY_END_STR {\n        return Err(MissingStartSentinel)\n    }\n    Ok(())\n}\n\npub fn validate_ed_pubkey_base64(pubkey: \u0026str) -\u003e Result\u003c(), PEMValidationError\u003e {\n    match base64decode(pubkey) {\n        Ok(k) =\u003e validate_ed_pubkey_pem(match std::str::from_utf8(k.as_ref()) {\n            Ok(k) =\u003e k,\n            Err(_) =\u003e return Err(InvalidBase64Data)\n        }),\n        Err(_) =\u003e Err(InvalidBase64Data)\n    }\n}\n\npub fn validate_dh_pubkey_base64(pubkey: \u0026str) -\u003e Result\u003c(), PEMValidationError\u003e {\n    match base64decode(pubkey) {\n        Ok(k) =\u003e validate_dh_pubkey_pem(match std::str::from_utf8(k.as_ref()) {\n            Ok(k) =\u003e k,\n            Err(_) =\u003e return Err(InvalidBase64Data)\n        }),\n        Err(_) =\u003e Err(InvalidBase64Data)\n    }\n}","traces":[],"covered":0,"coverable":0},{"path":["/","home","core","prj","e3t","trifid","trifid-api","src","main.rs"],"content":"extern crate core;\n\nuse std::error::Error;\nuse std::fs;\nuse std::path::Path;\nuse dotenvy::dotenv;\nuse log::{error, info};\nuse rocket::{catchers, Request, Response, routes};\nuse rocket::fairing::{Fairing, Info, Kind};\nuse rocket::http::Header;\nuse sqlx::migrate::Migrator;\nuse sqlx::postgres::PgPoolOptions;\nuse crate::config::TFConfig;\n\npub mod format;\npub mod util;\npub mod db;\npub mod config;\npub mod tokens;\npub mod routes;\npub mod auth;\npub mod crypto;\npub mod org;\n\nstatic MIGRATOR: Migrator = sqlx::migrate!();\n\npub struct CORS;\n\n#[rocket::async_trait]\nimpl Fairing for CORS {\n    fn info(\u0026self) -\u003e Info {\n        Info {\n            name: \"Add CORS headers to responses\",\n            kind: Kind::Response\n        }\n    }\n\n    async fn on_response\u003c'r\u003e(\u0026self, _request: \u0026'r Request\u003c'_\u003e, response: \u0026mut Response\u003c'r\u003e) {\n        response.set_header(Header::new(\"Access-Control-Allow-Origin\", \"*\"));\n        response.set_header(Header::new(\"Access-Control-Allow-Methods\", \"POST, GET, PATCH, OPTIONS\"));\n        response.set_header(Header::new(\"Access-Control-Allow-Headers\", \"*\"));\n        response.set_header(Header::new(\"Access-Control-Allow-Credentials\", \"true\"));\n    }\n}\n\n#[rocket::main]\nasync fn main() -\u003e Result\u003c(), Box\u003cdyn Error\u003e\u003e {\n    let _ = rocket::build();\n\n    info!(\"[tfapi] loading config\");\n\n    let _ = dotenv();\n\n    if std::env::var(\"CONFIG_FILE\").is_err() \u0026\u0026 !Path::new(\"config.toml\").exists() {\n        error!(\"[tfapi] fatal: the environment variable CONFIG_FILE is not set\");\n        error!(\"[tfapi]  help: try creating a .env file that sets it\");\n        error!(\"[tfapi]  help: or, create a file config.toml with your config, as it is loaded automatically\");\n        std::process::exit(1);\n    }\n\n    let config_file = if Path::new(\"config.toml\").exists() {\n        \"config.toml\".to_string()\n    } else {\n        std::env::var(\"CONFIG_FILE\").unwrap()\n    };\n\n    let config_data = match fs::read_to_string(\u0026config_file) {\n        Ok(d) =\u003e d,\n        Err(e) =\u003e {\n            error!(\"[tfapi] fatal: unable to read config from {}\", config_file);\n            error!(\"[tfapi] fatal: {}\", e);\n            std::process::exit(1);\n        }\n    };\n\n    let config: TFConfig = match toml::from_str(\u0026config_data) {\n        Ok(c) =\u003e c,\n        Err(e) =\u003e {\n            error!(\"[tfapi] fatal: unable to parse config from {}\", config_file);\n            error!(\"[tfapi] fatal: {}\", e);\n            std::process::exit(1);\n        }\n    };\n\n    info!(\"[tfapi] connecting to database pool\");\n\n    let pool = match PgPoolOptions::new().max_connections(5).connect(\u0026config.db_url).await {\n        Ok(p) =\u003e p,\n        Err(e) =\u003e {\n            error!(\"[tfapi] fatal: unable to connect to database pool\");\n            error!(\"[tfapi] fatal: {}\", e);\n            std::process::exit(1);\n        }\n    };\n\n    info!(\"[tfapi] running database migrations\");\n\n    MIGRATOR.run(\u0026pool).await?;\n\n    info!(\"[tfapi] building rocket config\");\n\n    let figment = rocket::Config::figment().merge((\"port\", config.listen_port));\n\n    let _ = rocket::custom(figment)\n        .mount(\"/\", routes![\n            crate::routes::v1::auth::magic_link::magiclink_request,\n            crate::routes::v1::auth::magic_link::options,\n            crate::routes::v1::signup::signup_request,\n            crate::routes::v1::signup::options,\n            crate::routes::v1::auth::verify_magic_link::verify_magic_link,\n            crate::routes::v1::auth::verify_magic_link::options,\n            crate::routes::v1::totp_authenticators::totp_authenticators_request,\n            crate::routes::v1::totp_authenticators::options,\n            crate::routes::v1::verify_totp_authenticator::verify_totp_authenticator_request,\n            crate::routes::v1::verify_totp_authenticator::options,\n            crate::routes::v1::auth::totp::totp_request,\n            crate::routes::v1::auth::totp::options,\n            crate::routes::v1::auth::check_session::check_session,\n            crate::routes::v1::auth::check_session::check_session_auth,\n            crate::routes::v1::auth::check_session::options,\n            crate::routes::v1::auth::check_session::options_auth,\n            crate::routes::v2::whoami::whoami_request,\n            crate::routes::v2::whoami::options,\n\n            crate::routes::v1::organization::options,\n            crate::routes::v1::organization::orgidoptions,\n            crate::routes::v1::organization::orginfo_req,\n            crate::routes::v1::organization::orglist_req,\n            crate::routes::v1::organization::create_org\n        ])\n        .register(\"/\", catchers![\n            crate::routes::handler_400,\n            crate::routes::handler_401,\n            crate::routes::handler_403,\n            crate::routes::handler_404,\n            crate::routes::handler_422,\n\n            crate::routes::handler_500,\n            crate::routes::handler_501,\n            crate::routes::handler_502,\n            crate::routes::handler_503,\n            crate::routes::handler_504,\n            crate::routes::handler_505,\n        ])\n        .attach(CORS)\n        .manage(pool)\n        .manage(config)\n        .launch().await?;\n\n    Ok(())\n}","traces":[{"line":38,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":39,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":40,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":41,"address":[],"length":0,"stats":{"Line":0},"fn_name":null},{"line":42,"address":[],"length":0,"stats":{"Line":0},"fn_name":null}],"covered":0,"coverable":5},{"path":["/","home","core","prj","e3t","trifid","trifid-api","src","org.rs"],"content":"use std::error::Error;\nuse rocket::form::validate::Contains;\nuse sqlx::PgPool;\n\npub async fn get_org_by_owner_id(user: i32, db: \u0026PgPool) -\u003e Result\u003cOption\u003ci32\u003e, Box\u003cdyn Error\u003e\u003e {\n    Ok(match sqlx::query!(\"SELECT id FROM organizations WHERE owner = $1\", user).fetch_optional(db).await? {\n        Some(r) =\u003e Some(r.id),\n        None =\u003e None\n    })\n}\n\npub async fn get_orgs_by_assoc_id(user: i32, db: \u0026PgPool) -\u003e Result\u003cVec\u003ci32\u003e, Box\u003cdyn Error\u003e\u003e {\n    let res: Vec\u003c_\u003e = sqlx::query!(\"SELECT org_id FROM organization_authorized_users WHERE user_id = $1\", user).fetch_all(db).await?;\n\n    let mut ret = vec![];\n\n    for i in res {\n        ret.push(i.org_id);\n    }\n\n    Ok(ret)\n}\n\npub async fn get_users_by_assoc_org(org: i32, db: \u0026PgPool) -\u003e Result\u003cVec\u003ci32\u003e, Box\u003cdyn Error\u003e\u003e {\n    let res: Vec\u003c_\u003e = sqlx::query!(\"SELECT user_id FROM organization_authorized_users WHERE org_id = $1\", org).fetch_all(db).await?;\n\n    let mut ret = vec![];\n\n    for i in res {\n        ret.push(i.org_id);\n    }\n\n    Ok(ret)\n}\n\npub async fn get_associated_orgs(user: i32, db: \u0026PgPool) -\u003e Result\u003cVec\u003ci32\u003e, Box\u003cdyn Error\u003e\u003e {\n    let mut assoc_orgs = vec![];\n\n    if let Some(owned_org) = get_org_by_owner_id(user, db).await? {\n        assoc_orgs.push(owned_org);\n    }\n\n    assoc_orgs.append(\u0026mut get_orgs_by_assoc_id(user, db).await?);\n\n    Ok(assoc_orgs)\n}\n\npub async fn user_has_org_assoc(user: i32, org: i32, db: \u0026PgPool) -\u003e Result\u003cbool, Box\u003cdyn Error\u003e\u003e {\n    Ok(get_associated_orgs(user, db).await?.contains(org))\n}","traces":[],"covered":0,"coverable":0},{"path":["/","home","core","prj","e3t","trifid","trifid-api","src","routes","mod.rs"],"content":"pub mod v1;\npub mod v2;\n\nuse rocket::catch;\nuse serde::{Serialize};\nuse rocket::http::Status;\n\npub const ERR_MSG_MALFORMED_REQUEST: \u0026str = \"unable to parse the request body - is it valid JSON, using correct types?\";\npub const ERR_MSG_MALFORMED_REQUEST_CODE: \u0026str = \"ERR_MALFORMED_REQUEST\";\n\n/*\nTODO:\n    /v1/auth/magic-link                         [done]\n    /v1/auth/totp                               [done]\n    /v1/auth/verify-magic-link                  [done]\n    /v1/hosts/host-{id}/enrollment-code\n    /v1/hosts/host-{id}/enrollment-code-check\n    /v1/hosts/host-{id}\n    /v1/roles/role-{id}\n    /v1/feature-flags\n    /v1/hosts\n    /v1/networks\n    /v1/roles\n    /v1/signup                                  [done]\n    /v1/totp-authenticators                     [done]\n    /v1/verify-totp-authenticator               [done]\n    /v1/dnclient\n    /v2/enroll\n    /v2/whoami                                  [in-progress]\n */\n\n#[derive(Serialize)]\n#[serde(crate = \"rocket::serde\")]\npub struct APIError {\n    errors: Vec\u003cAPIErrorSingular\u003e\n}\n#[derive(Serialize)]\n#[serde(crate = \"rocket::serde\")]\npub struct APIErrorSingular {\n    code: String,\n    message: String\n}\n\nmacro_rules! error_handler {\n    ($code: expr, $err: expr, $msg: expr) =\u003e {\n        ::paste::paste! {\n            #[catch($code)]\n            pub fn [\u003chandler_ $code\u003e]() -\u003e (Status, String) {\n                (Status::from_code($code).unwrap(), format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{}\\\"}}]}}\", $err, $msg))\n            }\n        }\n    };\n}\nerror_handler!(400, \"ERR_MALFORMED_REQUEST\", \"unable to parse the request body, is it properly formatted?\");\nerror_handler!(401, \"ERR_AUTHENTICATION_REQUIRED\", \"this endpoint requires authentication but it was not provided\");\nerror_handler!(403, \"ERR_UNAUTHORIZED\", \"authorization was provided but it is expired or invalid\");\nerror_handler!(404, \"ERR_NOT_FOUND\", \"resource not found\");\nerror_handler!(405, \"ERR_METHOD_NOT_ALLOWED\", \"method not allowed for this endpoint\");\nerror_handler!(422, \"ERR_MALFORMED_REQUEST\", \"unable to parse the request body, is it properly formatted?\");\n\nerror_handler!(500, \"ERR_QL_QUERY_FAILED\", \"graphql query timed out\");\nerror_handler!(501, \"ERR_NOT_IMPLEMENTED\", \"query not supported by this version of graphql\");\nerror_handler!(502, \"ERR_PROXY_ERR\", \"servers under load, please try again later\");\nerror_handler!(503, \"ERR_SERVER_OVERLOADED\", \"servers under load, please try again later\");\nerror_handler!(504, \"ERR_PROXY_TIMEOUT\", \"servers under load, please try again later\");\nerror_handler!(505, \"ERR_CLIENT_UNSUPPORTED\", \"your version of dnclient is out of date, please update\");\n","traces":[],"covered":0,"coverable":0},{"path":["/","home","core","prj","e3t","trifid","trifid-api","src","routes","v1","auth","check_session.rs"],"content":"use rocket::{post, options};\nuse crate::auth::{PartialUserInfo, TOTPAuthenticatedUserInfo};\n\n#[options(\"/v1/auth/check_session\")]\npub async fn options() -\u003e \u0026'static str {\n    \"\"\n}\n\n#[post(\"/v1/auth/check_session\")]\npub async fn check_session(_user: PartialUserInfo) -\u003e \u0026'static str {\n    \"ok\"\n}\n\n#[options(\"/v1/auth/check_auth\")]\npub async fn options_auth() -\u003e \u0026'static str {\n    \"\"\n}\n\n\n#[post(\"/v1/auth/check_auth\")]\npub async fn check_session_auth(_user: TOTPAuthenticatedUserInfo) -\u003e \u0026'static str {\n    \"ok\"\n}","traces":[],"covered":0,"coverable":0},{"path":["/","home","core","prj","e3t","trifid","trifid-api","src","routes","v1","auth","magic_link.rs"],"content":"use rocket::{post, State};\nuse rocket::serde::json::Json;\nuse serde::{Serialize, Deserialize};\nuse rocket::http::{ContentType, Status};\nuse sqlx::PgPool;\nuse crate::config::TFConfig;\nuse crate::tokens::send_magic_link;\nuse rocket::options;\n\n#[derive(Serialize, Deserialize)]\n#[serde(crate = \"rocket::serde\")]\npub struct MagicLinkRequest {\n    pub email: String,\n}\n\n#[derive(Serialize, Deserialize)]\n#[serde(crate = \"rocket::serde\")]\npub struct MagicLinkResponseMetadata {}\n\n#[derive(Serialize, Deserialize)]\n#[serde(crate = \"rocket::serde\")]\npub struct MagicLinkResponse {\n    pub data: Option\u003cString\u003e,\n    pub metadata: MagicLinkResponseMetadata,\n}\n\n\n#[options(\"/v1/auth/magic-link\")]\npub async fn options() -\u003e \u0026'static str {\n    \"\"\n}\n\n#[post(\"/v1/auth/magic-link\", data = \"\u003creq\u003e\")]\npub async fn magiclink_request(req: Json\u003cMagicLinkRequest\u003e, pool: \u0026State\u003cPgPool\u003e, config: \u0026State\u003cTFConfig\u003e) -\u003e Result\u003c(ContentType, Json\u003cMagicLinkResponse\u003e), (Status, String)\u003e {\n    // figure out if the user already exists\n    let mut id = -1;\n    match sqlx::query!(\"SELECT id FROM users WHERE email = $1\", req.email.clone()).fetch_optional(pool.inner()).await {\n        Ok(res) =\u003e if let Some(r) = res { id = r.id as i64 },\n        Err(e) =\u003e {\n            return Err((Status::InternalServerError, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{} - {}\\\"}}]}}\", \"ERR_QL_QUERY_FAILED\", \"an error occurred while running the graphql query\", e)))\n        }\n    }\n\n    if id == -1 {\n        return Err((Status::Unauthorized, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{}\\\"}}]}}\", \"ERR_UNAUTHORIZED\", \"authorization was provided but it is expired or invalid\")))\n    }\n\n    // send magic link to email\n    match send_magic_link(id, req.email.clone(), pool.inner(), config.inner()).await {\n        Ok(_) =\u003e (),\n        Err(e) =\u003e {\n            return Err((Status::InternalServerError, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{} - {}\\\"}}]}}\", \"ERR_QL_QUERY_FAILED\", \"an error occurred while running the graphql query\", e)))\n        }\n    };\n\n    // this endpoint doesn't actually ever return an error? it will send you the magic link no matter what\n    // this appears to do the exact same thing as /v1/auth/magic-link, but it doesn't check if you have an account (magic-link does)\n    Ok((ContentType::JSON, Json(MagicLinkResponse {\n        data: None,\n        metadata: MagicLinkResponseMetadata {},\n    })))\n}","traces":[],"covered":0,"coverable":0},{"path":["/","home","core","prj","e3t","trifid","trifid-api","src","routes","v1","auth","mod.rs"],"content":"pub mod verify_magic_link;\npub mod magic_link;\npub mod totp;\npub mod check_session;","traces":[],"covered":0,"coverable":0},{"path":["/","home","core","prj","e3t","trifid","trifid-api","src","routes","v1","auth","totp.rs"],"content":"use rocket::http::{ContentType, Status};\nuse rocket::serde::json::Json;\nuse crate::auth::PartialUserInfo;\nuse serde::{Serialize, Deserialize};\nuse rocket::{post, State};\nuse sqlx::PgPool;\nuse rocket::options;\nuse crate::tokens::{generate_auth_token, get_totpmachine, user_has_totp};\n\npub const TOTP_GENERIC_UNAUTHORIZED_ERROR: \u0026str = \"{\\\"errors\\\":[{\\\"code\\\":\\\"ERR_INVALID_TOTP_CODE\\\",\\\"message\\\":\\\"invalid TOTP code (maybe it expired?)\\\",\\\"path\\\":\\\"code\\\"}]}\";\npub const TOTP_NO_TOTP_ERROR: \u0026str = \"{\\\"errors\\\":[{\\\"code\\\":\\\"ERR_NO_TOTP\\\",\\\"message\\\":\\\"logged-in user does not have totp enabled\\\",\\\"path\\\":\\\"code\\\"}]}\";\n\n#[derive(Serialize, Deserialize)]\n#[serde(crate = \"rocket::serde\")]\npub struct TotpRequest {\n    pub code: String\n}\n\n#[derive(Serialize, Deserialize)]\n#[serde(crate = \"rocket::serde\")]\npub struct TotpResponseData {\n    #[serde(rename = \"authToken\")]\n    auth_token: String\n}\n#[derive(Serialize, Deserialize)]\n#[serde(crate = \"rocket::serde\")]\npub struct TotpResponseMetadata {\n}\n#[derive(Serialize, Deserialize)]\n#[serde(crate = \"rocket::serde\")]\npub struct TotpResponse {\n    data: TotpResponseData,\n    metadata: TotpResponseMetadata\n}\n\n#[options(\"/v1/auth/totp\")]\npub async fn options() -\u003e \u0026'static str {\n    \"\"\n}\n\n\n#[post(\"/v1/auth/totp\", data = \"\u003creq\u003e\")]\npub async fn totp_request(req: Json\u003cTotpRequest\u003e, user: PartialUserInfo, db: \u0026State\u003cPgPool\u003e) -\u003e Result\u003c(ContentType, Json\u003cTotpResponse\u003e), (Status, String)\u003e {\n    if !match user_has_totp(user.user_id, db.inner()).await {\n        Ok(b) =\u003e b,\n        Err(e) =\u003e return Err((Status::InternalServerError, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{} - {}\\\"}}]}}\", \"ERR_UNABLE_TO_ISSUE\", \"an error occured trying to issue a session token, please try again later\", e)))\n    } {\n        return Err((Status::UnprocessableEntity, TOTP_NO_TOTP_ERROR.to_string()))\n    }\n\n    if user.has_totp_auth {\n        return Err((Status::BadRequest, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{}\\\"}}]}}\", \"ERR_TOTP_ALREADY_AUTHED\", \"user already has valid totp authentication\")))\n    }\n\n    let totpmachine = match get_totpmachine(user.user_id, db.inner()).await {\n        Ok(t) =\u003e t,\n        Err(e) =\u003e {\n            return Err((Status::InternalServerError, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{} - {}\\\"}}]}}\", \"ERR_UNABLE_TO_ISSUE\", \"an error occured trying to issue a session token, please try again later\", e)))\n        }\n    };\n\n    if !totpmachine.check_current(\u0026req.0.code).unwrap_or(false) {\n        return Err((Status::Unauthorized, TOTP_GENERIC_UNAUTHORIZED_ERROR.to_string()))\n    }\n\n    Ok((ContentType::JSON, Json(TotpResponse {\n        data: TotpResponseData { auth_token: match generate_auth_token(user.user_id as i64, user.session_id, db.inner()).await {\n            Ok(t) =\u003e t,\n            Err(e) =\u003e { return Err((Status::InternalServerError, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{} - {}\\\"}}]}}\", \"ERR_UNABLE_TO_ISSUE\", \"an error occured trying to issue a session token, please try again later\", e))) }\n        } },\n        metadata: TotpResponseMetadata {},\n    })))\n}","traces":[],"covered":0,"coverable":0},{"path":["/","home","core","prj","e3t","trifid","trifid-api","src","routes","v1","auth","verify_magic_link.rs"],"content":"use std::time::{SystemTime, UNIX_EPOCH};\nuse rocket::http::{ContentType, Status};\nuse rocket::serde::json::Json;\nuse serde::{Serialize, Deserialize};\nuse rocket::{post, State};\nuse sqlx::PgPool;\nuse crate::config::TFConfig;\nuse crate::tokens::generate_session_token;\nuse rocket::options;\n\n#[derive(Serialize, Deserialize)]\n#[serde(crate = \"rocket::serde\")]\npub struct VerifyMagicLinkRequest {\n    #[serde(rename = \"magicLinkToken\")]\n    pub magic_link_token: String,\n}\n\n\n#[derive(Serialize, Deserialize)]\npub struct VerifyMagicLinkResponseMetadata {}\n\n#[derive(Serialize, Deserialize)]\npub struct VerifyMagicLinkResponseData {\n    #[serde(rename = \"sessionToken\")]\n    pub session_token: String,\n}\n\n#[derive(Serialize, Deserialize)]\npub struct VerifyMagicLinkResponse {\n    pub data: VerifyMagicLinkResponseData,\n    pub metadata: VerifyMagicLinkResponseMetadata,\n}\n\n#[options(\"/v1/auth/verify-magic-link\")]\npub async fn options() -\u003e \u0026'static str {\n    \"\"\n}\n\n\n#[post(\"/v1/auth/verify-magic-link\", data = \"\u003creq\u003e\")]\npub async fn verify_magic_link(req: Json\u003cVerifyMagicLinkRequest\u003e, db: \u0026State\u003cPgPool\u003e, config: \u0026State\u003cTFConfig\u003e) -\u003e Result\u003c(ContentType, Json\u003cVerifyMagicLinkResponse\u003e), (Status, String)\u003e {\n    // get the current time to check if the token is expired\n    let (user_id, expired_at) = match sqlx::query!(\"SELECT user_id, expires_on FROM magic_links WHERE id = $1\", req.0.magic_link_token).fetch_one(db.inner()).await {\n        Ok(row) =\u003e (row.user_id, row.expires_on),\n        Err(e) =\u003e {\n            return Err((Status::Unauthorized, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{} - {}\\\"}}]}}\", \"ERR_UNAUTHORIZED\", \"this token is invalid\", e)))\n        }\n    };\n    let current_time = SystemTime::now().duration_since(UNIX_EPOCH).unwrap().as_secs() as i32;\n    println!(\"expired on {}, currently {}\", expired_at, current_time);\n    if expired_at \u003c current_time {\n        return Err((Status::Unauthorized, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{}\\\"}}]}}\", \"ERR_UNAUTHORIZED\", \"valid authorization was provided but it is expired\")))\n    }\n\n    // generate session token\n    let token = match generate_session_token(user_id as i64, db.inner(), config.inner()).await {\n        Ok(t) =\u003e t,\n        Err(e) =\u003e {\n            return Err((Status::InternalServerError, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{} - {}\\\"}}]}}\", \"ERR_UNABLE_TO_ISSUE\", \"an error occured trying to issue a session token, please try again later\", e)))\n        }\n    };\n\n    // delete the token\n    match sqlx::query!(\"DELETE FROM magic_links WHERE id = $1\", req.0.magic_link_token).execute(db.inner()).await {\n        Ok(_) =\u003e (),\n        Err(e) =\u003e {\n            return Err((Status::InternalServerError, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{} - {}\\\"}}]}}\", \"ERR_UNABLE_TO_ISSUE\", \"an error occured trying to issue a session token, please try again later\", e)))\n        }\n    }\n\n    Ok((ContentType::JSON, Json(VerifyMagicLinkResponse {\n        data: VerifyMagicLinkResponseData { session_token: token },\n        metadata: VerifyMagicLinkResponseMetadata {},\n    })))\n}","traces":[],"covered":0,"coverable":0},{"path":["/","home","core","prj","e3t","trifid","trifid-api","src","routes","v1","mod.rs"],"content":"pub mod auth;\npub mod signup;\n\npub mod totp_authenticators;\npub mod verify_totp_authenticator;\npub mod organization;","traces":[],"covered":0,"coverable":0},{"path":["/","home","core","prj","e3t","trifid","trifid-api","src","routes","v1","organization.rs"],"content":"use std::slice::from_raw_parts_mut;\nuse rocket::{get, post, options, State};\nuse rocket::http::{ContentType, Status};\nuse rocket::serde::json::Json;\nuse serde::{Serialize, Deserialize};\nuse sqlx::PgPool;\nuse crate::auth::TOTPAuthenticatedUserInfo;\nuse crate::config::TFConfig;\nuse crate::org::{get_associated_orgs, get_org_by_owner_id, get_users_by_assoc_org, user_has_org_assoc};\n\n#[options(\"/v1/orgs\")]\npub fn options() -\u003e \u0026'static str {\n    \"\"\n}\n#[options(\"/v1/org/\u003c_id\u003e\")]\npub fn orgidoptions(_id: i32) -\u003e \u0026'static str {\n    \"\"\n}\n\n#[derive(Serialize, Deserialize)]\n#[serde(crate = \"rocket::serde\")]\npub struct OrglistStruct {\n    pub org_ids: Vec\u003ci32\u003e\n}\n\n\n#[get(\"/v1/orgs\")]\npub async fn orglist_req(user: TOTPAuthenticatedUserInfo, db: \u0026State\u003cPgPool\u003e) -\u003e Result\u003c(ContentType, Json\u003cOrglistStruct\u003e), (Status, String)\u003e {\n    // this endpoint lists the associated organizations this user has access to\n    let associated_orgs = match get_associated_orgs(user.user_id, db.inner()).await {\n        Ok(r) =\u003e r,\n        Err(e) =\u003e return Err((Status::InternalServerError, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{} - {}\\\"}}]}}\", \"ERR_DB_QUERY_FAILED\", \"an error occurred while running the database query\")))\n    };\n\n    Ok((ContentType::JSON, Json(OrglistStruct {\n        org_ids: associated_orgs\n    })))\n}\n\n#[derive(Serialize, Deserialize)]\n#[serde(crate = \"rocket::serde\")]\npub struct OrginfoStruct {\n    pub org_id: i32,\n    pub owner_id: i32,\n    pub ca_crt: String,\n    pub authorized_users: Vec\u003ci32\u003e\n}\n\n#[get(\"/v1/org/\u003corgid\u003e\")]\npub async fn orginfo_req(orgid: i32, user: TOTPAuthenticatedUserInfo, db: \u0026State\u003cPgPool\u003e) -\u003e Result\u003c(ContentType, Json\u003cOrginfoStruct\u003e), (Status, String)\u003e {\n    if !user_has_org_assoc(orgid, user.user_id, db.inner()).await.map_err(|e| (Status::InternalServerError, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{} - {}\\\"}}]}}\", \"ERR_QL_QUERY_FAILED\", \"an error occurred while running the graphql query\", e)))? {\n        return Err((Status::Unauthorized, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{}\\\"}}]}}\", \"ERR_MISSING_ORG_AUTHORIZATION\", \"this user does not have permission to access this org\")));\n    }\n\n    let org = sqlx::query!(\"SELECT id, owner, ca_crt FROM organizations WHERE id = $1\", orgid).fetch_one(orgid).await.map_err(|e| (Status::InternalServerError, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{} - {}\\\"}}]}}\", \"ERR_QL_QUERY_FAILED\", \"an error occurred while running the graphql query\", e)))?;\n    let authorized_users = get_users_by_assoc_org(orgid, db.inner()).await.map_err(|e| (Status::InternalServerError, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{} - {}\\\"}}]}}\", \"ERR_QL_QUERY_FAILED\", \"an error occurred while running the graphql query\", e)))?;\n\n    Ok((ContentType::JSON, Json(\n        OrginfoStruct {\n            org_id: orgid,\n            owner_id: org.owner,\n            ca_crt: org.ca_crt,\n            authorized_users,\n        }\n    )))\n}\n\n#[post(\"/v1/org\")]\npub async fn create_org(user: TOTPAuthenticatedUserInfo, db: \u0026State\u003cPgPool\u003e, config: \u0026State\u003cTFConfig\u003e) -\u003e Result\u003c(ContentType, Json\u003cOrginfoStruct\u003e), (Status, String)\u003e {\n    if get_org_by_owner_id(user.user_id, db.inner()).await.map_err(|e| (Status::InternalServerError, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{} - {}\\\"}}]}}\", \"ERR_QL_QUERY_FAILED\", \"an error occurred while running the graphql query\", e)))?.is_some() {\n        return Err((Status::Conflict, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{}\\\"}}]}}\", \"ERR_USER_OWNS_ORG\", \"a user can only own one organization at a time\")))\n    }\n\n    // we need to generate a keypair and CA certificate for this new org\n\n    Ok((ContentType::JSON, Json(\n        OrginfoStruct {\n            org_id: orgid,\n            owner_id: org.owner,\n            ca_crt: org.ca_crt,\n            authorized_users,\n        }\n    )))\n}","traces":[],"covered":0,"coverable":0},{"path":["/","home","core","prj","e3t","trifid","trifid-api","src","routes","v1","signup.rs"],"content":"use rocket::{post, State};\nuse rocket::serde::json::Json;\nuse serde::{Serialize, Deserialize};\nuse std::time::{SystemTime, UNIX_EPOCH};\nuse rocket::http::{ContentType, Status};\nuse sqlx::PgPool;\nuse crate::config::TFConfig;\nuse crate::tokens::send_magic_link;\nuse rocket::options;\n\n#[derive(Serialize, Deserialize)]\n#[serde(crate = \"rocket::serde\")]\npub struct SignupRequest {\n    pub email: String,\n}\n\n#[derive(Serialize, Deserialize)]\n#[serde(crate = \"rocket::serde\")]\npub struct SignupResponseMetadata {}\n\n#[derive(Serialize, Deserialize)]\n#[serde(crate = \"rocket::serde\")]\npub struct SignupResponse {\n    pub data: Option\u003cString\u003e,\n    pub metadata: SignupResponseMetadata,\n}\n/*\ncreated_on TIMESTAMP NOT NULL,\n\n    banned INTEGER NOT NULL,\n    ban_reason VARCHAR(1024) NOT NULL\n */\n#[options(\"/v1/signup\")]\npub async fn options() -\u003e \u0026'static str {\n    \"\"\n}\n\n#[post(\"/v1/signup\", data = \"\u003creq\u003e\")]\npub async fn signup_request(req: Json\u003cSignupRequest\u003e, pool: \u0026State\u003cPgPool\u003e, config: \u0026State\u003cTFConfig\u003e) -\u003e Result\u003c(ContentType, Json\u003cSignupResponse\u003e), (Status, String)\u003e {\n    // figure out if the user already exists\n    let mut id = -1;\n    match sqlx::query!(\"SELECT id FROM users WHERE email = $1\", req.email.clone()).fetch_optional(pool.inner()).await {\n        Ok(res) =\u003e if let Some(r) = res { id = r.id as i64 },\n        Err(e) =\u003e {\n            return Err((Status::InternalServerError, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{} - {}\\\"}}]}}\", \"ERR_QL_QUERY_FAILED\", \"an error occurred while running the graphql query\", e)))\n        }\n    }\n\n    if id == -1 {\n        let id_res = match sqlx::query!(\"INSERT INTO users (email, created_on, banned, ban_reason, totp_secret, totp_otpurl, totp_verified) VALUES ($1, $2, $3, $4, $5, $6, $7) ON CONFLICT DO NOTHING RETURNING id;\", req.email, SystemTime::now().duration_since(UNIX_EPOCH).unwrap().as_secs() as i64, 0, \"\", \"\", \"\", 0).fetch_one(pool.inner()).await {\n            Ok(row) =\u003e row.id,\n            Err(e) =\u003e {\n                return Err((Status::InternalServerError, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{} - {}\\\"}}]}}\", \"ERR_QL_QUERY_FAILED\", \"an error occurred while running the graphql query\", e)))\n            }\n        };\n        id = id_res as i64;\n    }\n\n    // send magic link to email\n    match send_magic_link(id, req.email.clone(), pool.inner(), config.inner()).await {\n        Ok(_) =\u003e (),\n        Err(e) =\u003e {\n            return Err((Status::InternalServerError, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{} - {}\\\"}}]}}\", \"ERR_QL_QUERY_FAILED\", \"an error occurred while running the graphql query\", e)))\n        }\n    };\n\n    // this endpoint doesn't actually ever return an error? it will send you the magic link no matter what\n    // this appears to do the exact same thing as /v1/auth/magic-link, but it doesn't check if you have an account (magic-link does)\n    Ok((ContentType::JSON, Json(SignupResponse {\n        data: None,\n        metadata: SignupResponseMetadata {},\n    })))\n}","traces":[],"covered":0,"coverable":0},{"path":["/","home","core","prj","e3t","trifid","trifid-api","src","routes","v1","totp_authenticators.rs"],"content":"use rocket::http::{ContentType, Status};\nuse rocket::serde::json::Json;\nuse rocket::{State, post};\nuse sqlx::PgPool;\nuse serde::{Serialize, Deserialize};\nuse crate::auth::PartialUserInfo;\nuse crate::config::TFConfig;\nuse crate::tokens::{create_totp_token, user_has_totp};\nuse rocket::options;\n\n#[derive(Deserialize)]\npub struct TotpAuthenticatorsRequest {}\n#[derive(Serialize, Deserialize)]\n#[serde(crate = \"rocket::serde\")]\npub struct TotpAuthenticatorsResponseMetadata {}\n#[derive(Serialize, Deserialize)]\n#[serde(crate = \"rocket::serde\")]\npub struct TotpAuthenticatorsResponseData {\n    #[serde(rename = \"totpToken\")]\n    pub totp_token: String,\n    pub secret: String,\n    pub url: String,\n}\n#[derive(Serialize, Deserialize)]\n#[serde(crate = \"rocket::serde\")]\npub struct TotpAuthenticatorsResponse {\n    pub data: TotpAuthenticatorsResponseData,\n    pub metadata: TotpAuthenticatorsResponseMetadata,\n}\n\n#[options(\"/v1/totp-authenticators\")]\npub async fn options() -\u003e \u0026'static str {\n    \"\"\n}\n\n\n#[post(\"/v1/totp-authenticators\", data = \"\u003c_req\u003e\")]\npub async fn totp_authenticators_request(_req: Json\u003cTotpAuthenticatorsRequest\u003e, user: PartialUserInfo, db: \u0026State\u003cPgPool\u003e, config: \u0026State\u003cTFConfig\u003e) -\u003e Result\u003c(ContentType, Json\u003cTotpAuthenticatorsResponse\u003e), (Status, String)\u003e {\n    if match user_has_totp(user.user_id, db.inner()).await {\n        Ok(b) =\u003e b,\n        Err(e) =\u003e return Err((Status::InternalServerError, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{} - {}\\\"}}]}}\", \"ERR_UNABLE_TO_ISSUE\", \"an error occured trying to issue a session token, please try again later\", e)))\n    } {\n        return Err((Status::BadRequest, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{}\\\"}}]}}\", \"ERR_TOTP_ALREADY_EXISTS\", \"this user already has a totp authenticator on their account\")))\n    }\n\n    // generate a totp token\n    let (totptoken, totpmachine) = match create_totp_token(user.email, db.inner(), config.inner()).await {\n        Ok(t) =\u003e t,\n        Err(e) =\u003e return Err((Status::InternalServerError, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{} - {}\\\"}}]}}\", \"ERR_UNABLE_TO_ISSUE\", \"an error occured issuing a totp token, try again later\", e)))\n    };\n\n    Ok((ContentType::JSON, Json(TotpAuthenticatorsResponse {\n        data: TotpAuthenticatorsResponseData {\n            totp_token: totptoken,\n            secret: totpmachine.get_secret_base32(),\n            url: totpmachine.get_url(),\n        },\n        metadata: TotpAuthenticatorsResponseMetadata {},\n    })))\n}","traces":[],"covered":0,"coverable":0},{"path":["/","home","core","prj","e3t","trifid","trifid-api","src","routes","v1","verify_totp_authenticator.rs"],"content":"/*\n{\"totpToken\":\"totp-mH9eLzA9Q5WB-sg3Fq8CfkP13eTh3DxF25kVK2VEDOk\",\"code\":\"266242\"}\n{\"errors\":[{\"code\":\"ERR_INVALID_TOTP_TOKEN\",\"message\":\"TOTP token does not exist (maybe it expired?)\",\"path\":\"totpToken\"}]}\n\n\n{\"totpToken\":\"totp-gaUDaxPrrIBc8GEQ6z0vPisT8k0MEP1fgI8FA2ztLMw\",\"code\":\"175543\"}\n{\"data\":{\"authToken\":\"auth-O7mugxdYta-RKtLMqDW4j8XCJ85EfZKKezeZZXBYtFQ\"},\"metadata\":{}}\n*/\n\nuse rocket::http::{ContentType, Status};\nuse crate::auth::PartialUserInfo;\nuse rocket::post;\nuse rocket::serde::json::Json;\nuse rocket::State;\nuse serde::{Serialize, Deserialize};\nuse sqlx::PgPool;\nuse crate::tokens::{generate_auth_token, use_totp_token, verify_totp_token};\nuse rocket::options;\n\n#[derive(Serialize, Deserialize)]\npub struct VerifyTotpAuthenticatorRequest {\n    #[serde(rename = \"totpToken\")]\n    pub totp_token: String,\n    pub code: String,\n}\n\n#[derive(Serialize, Deserialize)]\npub struct VerifyTotpAuthenticatorResponseMetadata {}\n\n#[derive(Serialize, Deserialize)]\npub struct VerifyTotpAuthenticatorResponseData {\n    #[serde(rename = \"authToken\")]\n    pub auth_token: String,\n}\n\n#[derive(Serialize, Deserialize)]\npub struct VerifyTotpAuthenticatorResponse {\n    pub data: VerifyTotpAuthenticatorResponseData,\n    pub metadata: VerifyTotpAuthenticatorResponseMetadata,\n}\n\n#[options(\"/v1/verify-totp-authenticator\")]\npub async fn options() -\u003e \u0026'static str {\n    \"\"\n}\n\n\n#[post(\"/v1/verify-totp-authenticator\", data = \"\u003creq\u003e\")]\npub async fn verify_totp_authenticator_request(req: Json\u003cVerifyTotpAuthenticatorRequest\u003e, db: \u0026State\u003cPgPool\u003e, user: PartialUserInfo) -\u003e Result\u003c(ContentType, Json\u003cVerifyTotpAuthenticatorResponse\u003e), (Status, String)\u003e {\n    let totpmachine = match verify_totp_token(req.0.totp_token.clone(), user.email.clone(), db.inner()).await {\n        Ok(t) =\u003e t,\n        Err(e) =\u003e return Err((Status::Unauthorized, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{} - {}\\\"}}]}}\", \"ERR_UNAUTHORIZED\", \"this token is invalid\", e)))\n    };\n    if !totpmachine.check_current(\u0026req.0.code).unwrap() {\n        return Err((Status::Unauthorized, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{}\\\",\\\"path\\\":\\\"totpToken\\\"}}]}}\", \"ERR_INVALID_TOTP_CODE\", \"Invalid TOTP code\")))\n    }\n    match use_totp_token(req.0.totp_token, user.email, db.inner()).await {\n        Ok(_) =\u003e (),\n        Err(e) =\u003e return Err((Status::InternalServerError, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{} - {}\\\"}}]}}\", \"ERR_UNABLE_TO_ISSUE\", \"an error occured trying to issue a session token, please try again later\", e)))\n    }\n    Ok((ContentType::JSON, Json(VerifyTotpAuthenticatorResponse {\n        data: VerifyTotpAuthenticatorResponseData { auth_token: match generate_auth_token(user.user_id as i64, user.session_id, db.inner()).await {\n            Ok(at) =\u003e at,\n            Err(e) =\u003e return Err((Status::InternalServerError, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{} - {}\\\"}}]}}\", \"ERR_UNABLE_TO_ISSUE\", \"an error occured trying to issue a session token, please try again later\", e)))\n        } },\n        metadata: VerifyTotpAuthenticatorResponseMetadata {},\n    })))\n}","traces":[],"covered":0,"coverable":0},{"path":["/","home","core","prj","e3t","trifid","trifid-api","src","routes","v2","mod.rs"],"content":"pub mod whoami;","traces":[],"covered":0,"coverable":0},{"path":["/","home","core","prj","e3t","trifid","trifid-api","src","routes","v2","whoami.rs"],"content":"use chrono::{NaiveDateTime, Utc};\nuse serde::{Serialize, Deserialize};\nuse rocket::{options, get, State};\nuse rocket::http::{ContentType, Status};\nuse rocket::serde::json::Json;\nuse sqlx::PgPool;\nuse crate::auth::PartialUserInfo;\nuse crate::tokens::user_has_totp;\n\n#[derive(Serialize, Deserialize)]\npub struct WhoamiMetadata {}\n\n#[derive(Serialize, Deserialize)]\npub struct WhoamiActor {\n    pub id: String,\n    #[serde(rename = \"organizationID\")]\n    pub organization_id: String,\n    pub email: String,\n    #[serde(rename = \"createdAt\")]\n    pub created_at: String,\n    #[serde(rename = \"hasTOTPAuthenticator\")]\n    pub has_totpauthenticator: bool,\n}\n\n#[derive(Serialize, Deserialize)]\npub struct WhoamiData {\n    #[serde(rename = \"actorType\")]\n    pub actor_type: String,\n    pub actor: WhoamiActor,\n}\n\n#[derive(Serialize, Deserialize)]\npub struct WhoamiResponse {\n    pub data: WhoamiData,\n    pub metadata: WhoamiMetadata,\n}\n\n#[options(\"/v2/whoami\")]\npub fn options() -\u003e \u0026'static str {\n    \"\"\n}\n\n#[get(\"/v2/whoami\")]\npub async fn whoami_request(user: PartialUserInfo, db: \u0026State\u003cPgPool\u003e) -\u003e Result\u003c(ContentType, Json\u003cWhoamiResponse\u003e), (Status, String)\u003e {\n    Ok((ContentType::JSON, Json(WhoamiResponse {\n        data: WhoamiData {\n            actor_type: \"user\".to_string(),\n            actor: WhoamiActor {\n                id: user.user_id.to_string(),\n                organization_id: \"TEMP_ORG_BECAUSE_THAT_ISNT_IMPLEMENTED_YET\".to_string(),\n                email: user.email,\n                created_at: NaiveDateTime::from_timestamp_opt(user.created_at, 0).unwrap().and_local_timezone(Utc).unwrap().to_rfc3339(),\n                has_totpauthenticator: match user_has_totp(user.user_id, db.inner()).await {\n                    Ok(b) =\u003e b,\n                    Err(e) =\u003e return Err((Status::InternalServerError, format!(\"{{\\\"errors\\\":[{{\\\"code\\\":\\\"{}\\\",\\\"message\\\":\\\"{} - {}\\\"}}]}}\", \"ERR_DBERROR\", \"an error occured trying to verify your user\", e)))\n                },\n            }\n        },\n        metadata: WhoamiMetadata {},\n    })))\n}","traces":[],"covered":0,"coverable":0},{"path":["/","home","core","prj","e3t","trifid","trifid-api","src","tokens.rs"],"content":"use std::error::Error;\nuse log::info;\nuse sqlx::PgPool;\nuse uuid::Uuid;\nuse crate::config::TFConfig;\nuse std::time::SystemTime;\nuse std::time::UNIX_EPOCH;\nuse totp_rs::{Secret, TOTP};\nuse crate::util::{TOTP_ALGORITHM, TOTP_DIGITS, TOTP_ISSUER, TOTP_SKEW, TOTP_STEP};\n\n// https://admin.defined.net/auth/magic-link?email=coredoescode%40gmail.com\u0026token=ml-ckBsgw_5IdK5VYgseBYcoV_v_cQjtdq1re_RhDu_MKg\npub async fn send_magic_link(id: i64, email: String, db: \u0026PgPool, config: \u0026TFConfig) -\u003e Result\u003c(), Box\u003cdyn Error\u003e\u003e {\n    let otp = format!(\"ml-{}\", Uuid::new_v4());\n    let otp_url = config.web_root.join(\u0026format!(\"/auth/magic-link?email={}\u0026token={}\", urlencoding::encode(\u0026email.clone()), otp.clone())).unwrap();\n    sqlx::query!(\"INSERT INTO magic_links (id, user_id, expires_on) VALUES ($1, $2, $3) ON CONFLICT DO NOTHING;\", otp, id as i32, SystemTime::now().duration_since(UNIX_EPOCH).unwrap().as_secs() as i32 + config.magic_links_valid_for as i32).execute(db).await?;\n    // TODO: send email\n    info!(\"sent magic link {} to {}, valid for {} seconds\", otp_url, email.clone(), config.magic_links_valid_for);\n    Ok(())\n}\n\npub async fn generate_session_token(user_id: i64, db: \u0026PgPool, config: \u0026TFConfig) -\u003e Result\u003cString, Box\u003cdyn Error\u003e\u003e {\n    let token = format!(\"st-{}\", Uuid::new_v4());\n    sqlx::query!(\"INSERT INTO session_tokens (id, user_id, expires_on) VALUES ($1, $2, $3) ON CONFLICT DO NOTHING;\", token, user_id as i32, SystemTime::now().duration_since(UNIX_EPOCH).unwrap().as_secs() as i32 + config.session_tokens_valid_for as i32).execute(db).await?;\n    Ok(token)\n}\npub async fn validate_session_token(token: String, db: \u0026PgPool) -\u003e Result\u003ci64, Box\u003cdyn Error\u003e\u003e {\n    Ok(sqlx::query!(\"SELECT user_id FROM session_tokens WHERE id = $1 AND expires_on \u003e $2\", token, SystemTime::now().duration_since(UNIX_EPOCH).unwrap().as_secs() as i32).fetch_one(db).await?.user_id as i64)\n}\n\npub async fn generate_auth_token(user_id: i64, session_id: String, db: \u0026PgPool) -\u003e Result\u003cString, Box\u003cdyn Error\u003e\u003e {\n    let token = format!(\"at-{}\", Uuid::new_v4());\n    sqlx::query!(\"INSERT INTO auth_tokens (id, session_token, user_id) VALUES ($1, $2, $3) ON CONFLICT DO NOTHING;\", token, session_id, user_id as i32).execute(db).await?;\n    Ok(token)\n}\npub async fn validate_auth_token(token: String, session_id: String, db: \u0026PgPool) -\u003e Result\u003c(), Box\u003cdyn Error\u003e\u003e {\n    validate_session_token(session_id.clone(), db).await?;\n    sqlx::query!(\"SELECT * FROM auth_tokens WHERE id = $1 AND session_token = $2\", token, session_id).fetch_one(db).await?;\n    Ok(())\n}\n\n\n/*\nCREATE TABLE totp_create_tokens (\n    id VARCHAR(39) NOT NULL PRIMARY KEY,\n    expires_on INTEGER NOT NULL,\n    totp_otpurl VARCHAR(3000) NOT NULL,\n    totp_secret VARCHAR(128) NOT NULL\n);\n */\n\npub async fn create_totp_token(email: String, db: \u0026PgPool, config: \u0026TFConfig) -\u003e Result\u003c(String, TOTP), Box\u003cdyn Error\u003e\u003e {\n    // create the TOTP parameters\n\n    let secret = Secret::generate_secret();\n    let totpmachine = TOTP::new(TOTP_ALGORITHM, TOTP_DIGITS, TOTP_SKEW, TOTP_STEP, secret.to_bytes().unwrap(), Some(TOTP_ISSUER.to_string()), email).unwrap();\n    let otpurl = totpmachine.get_url();\n    let otpsecret = totpmachine.get_secret_base32();\n\n    let otpid = format!(\"totp-{}\", Uuid::new_v4());\n\n    sqlx::query!(\"INSERT INTO totp_create_tokens (id, expires_on, totp_otpurl, totp_secret) VALUES ($1, $2, $3, $4);\", otpid.clone(), (SystemTime::now().duration_since(UNIX_EPOCH).unwrap().as_secs() as i64 + config.totp_verification_valid_for) as i32, otpurl, otpsecret).execute(db).await?;\n\n    Ok((otpid, totpmachine))\n}\n\npub async fn verify_totp_token(otpid: String, email: String, db: \u0026PgPool) -\u003e Result\u003cTOTP, Box\u003cdyn Error\u003e\u003e {\n    let totprow = sqlx::query!(\"SELECT * FROM totp_create_tokens WHERE id = $1 AND expires_on \u003e $2\", otpid, SystemTime::now().duration_since(UNIX_EPOCH).unwrap().as_secs() as i32).fetch_one(db).await?;\n    let secret = Secret::Encoded(totprow.totp_secret);\n    let totpmachine = TOTP::new(TOTP_ALGORITHM, TOTP_DIGITS, TOTP_SKEW, TOTP_STEP, secret.to_bytes().unwrap(), Some(TOTP_ISSUER.to_string()), email).unwrap();\n\n    if totpmachine.get_url() != totprow.totp_otpurl {\n        return Err(\"OTPURLs do not match (email does not match?)\".into())\n    }\n\n    Ok(totpmachine)\n}\n\npub async fn use_totp_token(otpid: String, email: String, db: \u0026PgPool) -\u003e Result\u003cTOTP, Box\u003cdyn Error\u003e\u003e {\n    let totpmachine = verify_totp_token(otpid.clone(), email.clone(), db).await?;\n    sqlx::query!(\"DELETE FROM totp_create_tokens WHERE id = $1\", otpid).execute(db).await?;\n    sqlx::query!(\"UPDATE users SET totp_otpurl = $1, totp_secret = $2, totp_verified = 1 WHERE email = $3\", totpmachine.get_url(), totpmachine.get_secret_base32(), email).execute(db).await?;\n    Ok(totpmachine)\n}\n\npub async fn get_totpmachine(user: i32, db: \u0026PgPool) -\u003e Result\u003cTOTP, Box\u003cdyn Error\u003e\u003e {\n    let user = sqlx::query!(\"SELECT totp_secret, totp_otpurl, email FROM users WHERE id = $1\", user).fetch_one(db).await?;\n    let secret = Secret::Encoded(user.totp_secret);\n    Ok(TOTP::new(TOTP_ALGORITHM, TOTP_DIGITS, TOTP_SKEW, TOTP_STEP, secret.to_bytes().unwrap(), Some(TOTP_ISSUER.to_string()), user.email).unwrap())\n}\n\npub async fn user_has_totp(user: i32, db: \u0026PgPool) -\u003e Result\u003cbool, Box\u003cdyn Error\u003e\u003e {\n    Ok(sqlx::query!(\"SELECT totp_verified FROM users WHERE id = $1\", user).fetch_one(db).await?.totp_verified == 1)\n}","traces":[],"covered":0,"coverable":0},{"path":["/","home","core","prj","e3t","trifid","trifid-api","src","util.rs"],"content":"use base64::Engine;\nuse totp_rs::Algorithm;\n\npub const TOTP_ALGORITHM: Algorithm = Algorithm::SHA1;\npub const TOTP_DIGITS: usize = 6;\npub const TOTP_SKEW: u8 = 1;\npub const TOTP_STEP: u64 = 30;\npub const TOTP_ISSUER: \u0026str = \"trifidapi\";\n\npub fn base64decode(val: \u0026str) -\u003e Result\u003cVec\u003cu8\u003e, base64::DecodeError\u003e {\n    base64::engine::general_purpose::STANDARD.decode(val)\n}\npub fn base64encode(val: Vec\u003cu8\u003e) -\u003e String {\n    base64::engine::general_purpose::STANDARD.encode(val)\n}","traces":[],"covered":0,"coverable":0},{"path":["/","home","core","prj","e3t","trifid","trifid-pki","src","ca.rs"],"content":"//! Structs to represent a pool of CA's and blacklisted certificates\n\nuse std::collections::HashMap;\nuse std::error::Error;\nuse std::fmt::{Display, Formatter};\nuse std::time::SystemTime;\nuse ed25519_dalek::VerifyingKey;\nuse crate::cert::{deserialize_nebula_certificate_from_pem, NebulaCertificate};\n\n/// A pool of trusted CA certificates, and certificates that should be blocked.\n/// This is equivalent to the `pki` section in a typical Nebula config.yml.\n#[derive(Default)]\npub struct NebulaCAPool {\n    /// The list of CA root certificates that should be trusted.\n    pub cas: HashMap\u003cString, NebulaCertificate\u003e,\n    /// The list of blocklisted certificate fingerprints\n    pub cert_blocklist: Vec\u003cString\u003e,\n    /// True if any of the member CAs certificates are expired. Must be handled.\n    pub expired: bool\n}\n\nimpl NebulaCAPool {\n    /// Create a new, blank CA pool\n    pub fn new() -\u003e Self {\n        Self::default()\n    }\n\n    /// Create a new CA pool from a set of PEM encoded CA certificates.\n    /// If any of the certificates are expired, the pool will **still be returned**, with the expired flag set.\n    /// This must be handled properly.\n    /// # Errors\n    /// This function will return an error if PEM data provided was invalid.\n    pub fn new_from_pem(bytes: \u0026[u8]) -\u003e Result\u003cSelf, Box\u003cdyn Error\u003e\u003e {\n        let pems = pem::parse_many(bytes)?;\n\n        let mut pool = Self::new();\n\n        for cert in pems {\n            match pool.add_ca_certificate(pem::encode(\u0026cert).as_bytes()) {\n                Ok(did_expire) =\u003e if did_expire { pool.expired = true },\n                Err(e) =\u003e return Err(e)\n            }\n        }\n\n        Ok(pool)\n    }\n\n    /// Add a given CA certificate to the CA pool. If the certificate is expired, it will **still be added** - the return value will be `true` instead of `false`\n    /// # Errors\n    /// This function will return an error if the certificate is invalid in any way.\n    pub fn add_ca_certificate(\u0026mut self, bytes: \u0026[u8]) -\u003e Result\u003cbool, Box\u003cdyn Error\u003e\u003e {\n        let cert = deserialize_nebula_certificate_from_pem(bytes)?;\n\n        if !cert.details.is_ca {\n            return Err(CaPoolError::NotACA.into())\n        }\n\n        if !cert.check_signature(\u0026VerifyingKey::from_bytes(\u0026cert.details.public_key)?)? {\n            return Err(CaPoolError::NotSelfSigned.into())\n        }\n\n        let fingerprint = cert.sha256sum()?;\n        let expired = cert.expired(SystemTime::now());\n\n        if expired { self.expired = true }\n\n        self.cas.insert(fingerprint, cert);\n\n       Ok(expired)\n    }\n\n    /// Blocklist the given certificate in the CA pool\n    pub fn blocklist_fingerprint(\u0026mut self, fingerprint: \u0026str) {\n        self.cert_blocklist.push(fingerprint.to_string());\n    }\n\n    /// Clears the list of blocklisted fingerprints\n    pub fn reset_blocklist(\u0026mut self) {\n        self.cert_blocklist = vec![];\n    }\n\n    /// Checks if the given certificate is blocklisted\n    pub fn is_blocklisted(\u0026self, cert: \u0026NebulaCertificate) -\u003e bool {\n        let Ok(h) = cert.sha256sum() else { return false };\n        self.cert_blocklist.contains(\u0026h)\n    }\n\n    /// Gets the CA certificate used to sign the given certificate\n    /// # Errors\n    /// This function will return an error if the certificate does not have an issuer attached (it is self-signed)\n    pub fn get_ca_for_cert(\u0026self, cert: \u0026NebulaCertificate) -\u003e Result\u003cOption\u003c\u0026NebulaCertificate\u003e, Box\u003cdyn Error\u003e\u003e {\n        if cert.details.issuer == String::new() {\n            return Err(CaPoolError::NoIssuer.into())\n        }\n\n        Ok(self.cas.get(\u0026cert.details.issuer))\n    }\n\n    /// Get a list of trusted CA fingerprints\n    pub fn get_fingerprints(\u0026self) -\u003e Vec\u003c\u0026String\u003e {\n        self.cas.keys().collect()\n    }\n}\n\n#[derive(Debug)]\n/// A list of errors that can happen when working with a CA Pool\npub enum CaPoolError {\n    /// Tried to add a non-CA cert to the CA pool\n    NotACA,\n    /// Tried to add a non-self-signed cert to the CA pool (all CAs must be root certificates)\n    NotSelfSigned,\n    /// Tried to look up a certificate that does not have an issuer field\n    NoIssuer\n}\nimpl Error for CaPoolError {}\nimpl Display for CaPoolError {\n    fn fmt(\u0026self, f: \u0026mut Formatter\u003c'_\u003e) -\u003e std::fmt::Result {\n        match self {\n            Self::NotACA =\u003e write!(f, \"Tried to add a non-CA cert to the CA pool\"),\n            Self::NotSelfSigned =\u003e write!(f, \"Tried to add a non-self-signed cert to the CA pool (all CAs must be root certificates)\"),\n            Self::NoIssuer =\u003e write!(f, \"Tried to look up a certificate with a null issuer field\")\n        }\n    }\n}","traces":[{"line":24,"address":[439120],"length":1,"stats":{"Line":1},"fn_name":"new"},{"line":25,"address":[439128],"length":1,"stats":{"Line":1},"fn_name":null},{"line":33,"address":[439962,440276,439152],"length":1,"stats":{"Line":0},"fn_name":"new_from_pem"},{"line":34,"address":[439319,439185],"length":1,"stats":{"Line":0},"fn_name":null},{"line":36,"address":[439309],"length":1,"stats":{"Line":0},"fn_name":null},{"line":38,"address":[440212,439541,440091,439447],"length":1,"stats":{"Line":0},"fn_name":null},{"line":39,"address":[439842,439763,439924],"length":1,"stats":{"Line":0},"fn_name":null},{"line":40,"address":[439973,440183],"length":1,"stats":{"Line":0},"fn_name":null},{"line":41,"address":[440010],"length":1,"stats":{"Line":0},"fn_name":null},{"line":45,"address":[440217],"length":1,"stats":{"Line":0},"fn_name":null},{"line":51,"address":[441708,440304],"length":1,"stats":{"Line":1},"fn_name":"add_ca_certificate"},{"line":52,"address":[440376,440534],"length":1,"stats":{"Line":1},"fn_name":null},{"line":54,"address":[440514],"length":1,"stats":{"Line":1},"fn_name":null},{"line":55,"address":[440614,440703],"length":1,"stats":{"Line":0},"fn_name":null},{"line":58,"address":[440728,440607,440970],"length":1,"stats":{"Line":3},"fn_name":null},{"line":59,"address":[441139],"length":1,"stats":{"Line":0},"fn_name":null},{"line":62,"address":[441215,441132,441333],"length":1,"stats":{"Line":2},"fn_name":null},{"line":63,"address":[441490,441305],"length":1,"stats":{"Line":2},"fn_name":null},{"line":65,"address":[441514],"length":1,"stats":{"Line":1},"fn_name":null},{"line":67,"address":[441652],"length":1,"stats":{"Line":1},"fn_name":null},{"line":71,"address":[441760],"length":1,"stats":{"Line":1},"fn_name":"blocklist_fingerprint"},{"line":72,"address":[441779],"length":1,"stats":{"Line":1},"fn_name":null},{"line":76,"address":[441824,441888],"length":1,"stats":{"Line":1},"fn_name":"reset_blocklist"},{"line":77,"address":[441842,441920],"length":1,"stats":{"Line":2},"fn_name":null},{"line":81,"address":[442212,442240,441952],"length":1,"stats":{"Line":1},"fn_name":"is_blocklisted"},{"line":82,"address":[442094,441974,442151],"length":1,"stats":{"Line":1},"fn_name":null},{"line":83,"address":[442173,442121],"length":1,"stats":{"Line":2},"fn_name":null},{"line":89,"address":[442256,442390],"length":1,"stats":{"Line":1},"fn_name":"get_ca_for_cert"},{"line":90,"address":[442289],"length":1,"stats":{"Line":1},"fn_name":null},{"line":91,"address":[442455],"length":1,"stats":{"Line":0},"fn_name":null},{"line":94,"address":[442422],"length":1,"stats":{"Line":1},"fn_name":null},{"line":98,"address":[442496],"length":1,"stats":{"Line":0},"fn_name":"get_fingerprints"},{"line":99,"address":[442515],"length":1,"stats":{"Line":0},"fn_name":null},{"line":115,"address":[442560],"length":1,"stats":{"Line":0},"fn_name":"fmt"},{"line":116,"address":[442587],"length":1,"stats":{"Line":0},"fn_name":null},{"line":117,"address":[442619],"length":1,"stats":{"Line":0},"fn_name":null},{"line":118,"address":[442676],"length":1,"stats":{"Line":0},"fn_name":null},{"line":119,"address":[442733],"length":1,"stats":{"Line":0},"fn_name":null}],"covered":20,"coverable":38},{"path":["/","home","core","prj","e3t","trifid","trifid-pki","src","cert.rs"],"content":"//! Manage Nebula PKI Certificates\n//! This is pretty much a direct port of nebula/cert/cert.go\n\nuse std::error::Error;\nuse std::fmt::{Display, Formatter};\nuse std::net::Ipv4Addr;\nuse std::ops::Add;\nuse std::time::{Duration, SystemTime, UNIX_EPOCH};\nuse ed25519_dalek::{Signature, Signer, SigningKey, Verifier, VerifyingKey};\nuse ipnet::{Ipv4Net};\nuse pem::Pem;\nuse quick_protobuf::{BytesReader, MessageRead, MessageWrite, Writer};\nuse sha2::Sha256;\nuse crate::ca::NebulaCAPool;\nuse crate::cert_codec::{RawNebulaCertificate, RawNebulaCertificateDetails};\nuse sha2::Digest;\n\n/// The length, in bytes, of public keys\npub const PUBLIC_KEY_LENGTH: i32 = 32;\n\n/// The PEM banner for certificates\npub const CERT_BANNER: \u0026str = \"NEBULA CERTIFICATE\";\n/// The PEM banner for X25519 private keys\npub const X25519_PRIVATE_KEY_BANNER: \u0026str = \"NEBULA X25519 PRIVATE KEY\";\n/// The PEM banner for X25519 public keys\npub const X25519_PUBLIC_KEY_BANNER: \u0026str = \"NEBULA X25519 PUBLIC KEY\";\n/// The PEM banner for Ed25519 private keys\npub const ED25519_PRIVATE_KEY_BANNER: \u0026str = \"NEBULA ED25519 PRIVATE KEY\";\n/// The PEM banner for Ed25519 public keys\npub const ED25519_PUBLIC_KEY_BANNER: \u0026str = \"NEBULA ED25519 PUBLIC KEY\";\n\n/// A Nebula PKI certificate\n#[derive(Debug, Clone)]\npub struct NebulaCertificate {\n    /// The signed data of this certificate\n    pub details: NebulaCertificateDetails,\n    /// The Ed25519 signature of this certificate\n    pub signature: Vec\u003cu8\u003e\n}\n\n/// The signed details contained in a Nebula PKI certificate\n#[derive(Debug, Clone)]\npub struct NebulaCertificateDetails {\n    /// The name of the identity this certificate was issued for\n    pub name: String,\n    /// The IPv4 addresses issued to this node\n    pub ips: Vec\u003cIpv4Net\u003e,\n    /// The IPv4 subnets this node is responsible for routing\n    pub subnets: Vec\u003cIpv4Net\u003e,\n    /// The groups this node is a part of\n    pub groups: Vec\u003cString\u003e,\n    /// Certificate start date and time\n    pub not_before: SystemTime,\n    /// Certificate expiry date and time\n    pub not_after: SystemTime,\n    /// Public key\n    pub public_key: [u8; PUBLIC_KEY_LENGTH as usize],\n    /// Is this node a CA?\n    pub is_ca: bool,\n    /// SHA256 of issuer certificate. If blank, this cert is self-signed.\n    pub issuer: String\n}\n\n/// A list of errors that can occur parsing certificates\n#[derive(Debug)]\npub enum CertificateError {\n    /// Attempted to deserialize a certificate from an empty byte array\n    EmptyByteArray,\n    /// The encoded Details field is null\n    NilDetails,\n    /// The encoded Ips field is not formatted correctly\n    IpsNotPairs,\n    /// The encoded Subnets field is not formatted correctly\n    SubnetsNotPairs,\n    /// Signatures are expected to be 64 bytes but the signature on the certificate was a different length\n    WrongSigLength,\n    /// Public keys are expected to be 32 bytes but the public key on this cert is not\n    WrongKeyLength,\n    /// Certificates should have the PEM tag `NEBULA CERTIFICATE`, but this block did not\n    WrongPemTag,\n    /// This certificate either is not yet valid or has already expired\n    Expired,\n    /// The public key does not match the expected value\n    KeyMismatch\n}\nimpl Display for CertificateError {\n    fn fmt(\u0026self, f: \u0026mut Formatter\u003c'_\u003e) -\u003e std::fmt::Result {\n        match self {\n            Self::EmptyByteArray =\u003e write!(f, \"Certificate bytearray is empty\"),\n            Self::NilDetails =\u003e write!(f, \"The encoded Details field is null\"),\n            Self::IpsNotPairs =\u003e write!(f, \"encoded IPs should be in pairs, an odd number was found\"),\n            Self::SubnetsNotPairs =\u003e write!(f, \"encoded subnets should be in pairs, an odd number was found\"),\n            Self::WrongSigLength =\u003e write!(f, \"Signature should be 64 bytes but is a different size\"),\n            Self::WrongKeyLength =\u003e write!(f, \"Public keys are expected to be 32 bytes but the public key on this cert is not\"),\n            Self::WrongPemTag =\u003e write!(f, \"Certificates should have the PEM tag `NEBULA CERTIFICATE`, but this block did not\"),\n            Self::Expired =\u003e write!(f, \"This certificate either is not yet valid or has already expired\"),\n            Self::KeyMismatch =\u003e write!(f, \"Key does not match expected value\")\n        }\n    }\n}\nimpl Error for CertificateError {}\n\nfn map_cidr_pairs(pairs: \u0026[u32]) -\u003e Result\u003cVec\u003cIpv4Net\u003e, Box\u003cdyn Error\u003e\u003e {\n    let mut res_vec = vec![];\n    for pair in pairs.chunks(2) {\n        res_vec.push(Ipv4Net::with_netmask(Ipv4Addr::from(pair[0]), Ipv4Addr::from(pair[1]))?);\n    }\n    Ok(res_vec)\n}\n\nimpl Display for NebulaCertificate {\n    #[allow(clippy::unwrap_used)]\n    fn fmt(\u0026self, f: \u0026mut Formatter\u003c'_\u003e) -\u003e std::fmt::Result {\n        writeln!(f, \"NebulaCertificate {{\")?;\n        writeln!(f, \"   Details {{\")?;\n        writeln!(f, \"       Name: {}\", self.details.name)?;\n        writeln!(f, \"       Ips: {:?}\", self.details.ips)?;\n        writeln!(f, \"       Subnets: {:?}\", self.details.subnets)?;\n        writeln!(f, \"       Groups: {:?}\", self.details.groups)?;\n        writeln!(f, \"       Not before: {:?}\", self.details.not_before)?;\n        writeln!(f, \"       Not after: {:?}\", self.details.not_after)?;\n        writeln!(f, \"       Is CA: {}\", self.details.is_ca)?;\n        writeln!(f, \"       Issuer: {}\", self.details.issuer)?;\n        writeln!(f, \"       Public key: {}\", hex::encode(self.details.public_key))?;\n        writeln!(f, \"   }}\")?;\n        writeln!(f, \"   Fingerprint: {}\", self.sha256sum().unwrap())?;\n        writeln!(f, \"   Signature: {}\", hex::encode(self.signature.clone()))?;\n        writeln!(f, \"}}\")\n    }\n}\n\n/// Given a protobuf-encoded certificate bytearray, deserialize it into a `NebulaCertificate` object.\n/// # Errors\n/// This function will return an error if there is a protobuf parsing error, or if the certificate data is invalid.\n/// # Panics\npub fn deserialize_nebula_certificate(bytes: \u0026[u8]) -\u003e Result\u003cNebulaCertificate, Box\u003cdyn Error\u003e\u003e {\n    if bytes.is_empty() {\n        return Err(CertificateError::EmptyByteArray.into())\n    }\n\n    let mut reader = BytesReader::from_bytes(bytes);\n\n    let raw_cert = RawNebulaCertificate::from_reader(\u0026mut reader, bytes)?;\n\n    let details = raw_cert.Details.ok_or(CertificateError::NilDetails)?;\n\n    if details.Ips.len() % 2 != 0 {\n        return Err(CertificateError::IpsNotPairs.into())\n    }\n\n    if details.Subnets.len() % 2 != 0 {\n        return Err(CertificateError::SubnetsNotPairs.into())\n    }\n\n    let mut nebula_cert;\n    #[allow(clippy::cast_sign_loss)]\n    {\n        nebula_cert = NebulaCertificate {\n            details: NebulaCertificateDetails {\n                name: details.Name.to_string(),\n                ips: map_cidr_pairs(\u0026details.Ips)?,\n                subnets: map_cidr_pairs(\u0026details.Subnets)?,\n                groups: details.Groups.iter().map(std::string::ToString::to_string).collect(),\n                not_before: SystemTime::UNIX_EPOCH.add(Duration::from_secs(details.NotBefore as u64)),\n                not_after: SystemTime::UNIX_EPOCH.add(Duration::from_secs(details.NotAfter as u64)),\n                public_key: [0u8; 32],\n                is_ca: details.IsCA,\n                issuer: hex::encode(details.Issuer),\n            },\n            signature: vec![],\n        };\n    }\n\n    nebula_cert.signature = raw_cert.Signature;\n\n    if details.PublicKey.len() != 32 {\n        return Err(CertificateError::WrongKeyLength.into())\n    }\n\n    #[allow(clippy::unwrap_used)] { nebula_cert.details.public_key = details.PublicKey.try_into().unwrap(); }\n\n    Ok(nebula_cert)\n}\n\n/// A list of errors that can occur parsing keys\n#[derive(Debug)]\npub enum KeyError {\n    /// Keys should have their associated PEM tags but this had the wrong one\n    WrongPemTag\n}\nimpl Display for KeyError {\n    fn fmt(\u0026self, f: \u0026mut Formatter\u003c'_\u003e) -\u003e std::fmt::Result {\n        match self {\n            Self::WrongPemTag =\u003e write!(f, \"Keys should have their associated PEM tags but this had the wrong one\")\n        }\n    }\n}\nimpl Error for KeyError {}\n\n\n/// Deserialize the first PEM block in the given byte array into a `NebulaCertificate`\n/// # Errors\n/// This function will return an error if the PEM data is invalid, or if there is an error parsing the certificate (see `deserialize_nebula_certificate`)\npub fn deserialize_nebula_certificate_from_pem(bytes: \u0026[u8]) -\u003e Result\u003cNebulaCertificate, Box\u003cdyn Error\u003e\u003e {\n    let pem = pem::parse(bytes)?;\n    if pem.tag != CERT_BANNER {\n        return Err(CertificateError::WrongPemTag.into())\n    }\n    deserialize_nebula_certificate(\u0026pem.contents)\n}\n\n/// Simple helper to PEM encode an X25519 private key\npub fn serialize_x25519_private(bytes: \u0026[u8]) -\u003e Vec\u003cu8\u003e {\n    pem::encode(\u0026Pem {\n        tag: X25519_PRIVATE_KEY_BANNER.to_string(),\n        contents: bytes.to_vec(),\n    }).as_bytes().to_vec()\n}\n\n/// Simple helper to PEM encode an X25519 public key\npub fn serialize_x25519_public(bytes: \u0026[u8]) -\u003e Vec\u003cu8\u003e {\n    pem::encode(\u0026Pem {\n        tag: X25519_PUBLIC_KEY_BANNER.to_string(),\n        contents: bytes.to_vec(),\n    }).as_bytes().to_vec()\n}\n\n/// Attempt to deserialize a PEM encoded X25519 private key\n/// # Errors\n/// This function will return an error if the PEM data is invalid or has the wrong tag\npub fn deserialize_x25519_private(bytes: \u0026[u8]) -\u003e Result\u003cVec\u003cu8\u003e, Box\u003cdyn Error\u003e\u003e {\n    let pem = pem::parse(bytes)?;\n    if pem.tag != X25519_PRIVATE_KEY_BANNER {\n        return Err(KeyError::WrongPemTag.into())\n    }\n    Ok(pem.contents)\n}\n\n/// Attempt to deserialize a PEM encoded X25519 public key\n/// # Errors\n/// This function will return an error if the PEM data is invalid or has the wrong tag\npub fn deserialize_x25519_public(bytes: \u0026[u8]) -\u003e Result\u003cVec\u003cu8\u003e, Box\u003cdyn Error\u003e\u003e {\n    let pem = pem::parse(bytes)?;\n    if pem.tag != X25519_PUBLIC_KEY_BANNER {\n        return Err(KeyError::WrongPemTag.into())\n    }\n    Ok(pem.contents)\n}\n\n/// Simple helper to PEM encode an Ed25519 private key\npub fn serialize_ed25519_private(bytes: \u0026[u8]) -\u003e Vec\u003cu8\u003e {\n    pem::encode(\u0026Pem {\n        tag: ED25519_PRIVATE_KEY_BANNER.to_string(),\n        contents: bytes.to_vec(),\n    }).as_bytes().to_vec()\n}\n\n/// Simple helper to PEM encode an Ed25519 public key\npub fn serialize_ed25519_public(bytes: \u0026[u8]) -\u003e Vec\u003cu8\u003e {\n    pem::encode(\u0026Pem {\n        tag: ED25519_PUBLIC_KEY_BANNER.to_string(),\n        contents: bytes.to_vec(),\n    }).as_bytes().to_vec()\n}\n\n/// Attempt to deserialize a PEM encoded Ed25519 private key\n/// # Errors\n/// This function will return an error if the PEM data is invalid or has the wrong tag\npub fn deserialize_ed25519_private(bytes: \u0026[u8]) -\u003e Result\u003cVec\u003cu8\u003e, Box\u003cdyn Error\u003e\u003e {\n    let pem = pem::parse(bytes)?;\n    if pem.tag != ED25519_PRIVATE_KEY_BANNER {\n        return Err(KeyError::WrongPemTag.into())\n    }\n    Ok(pem.contents)\n}\n\n/// Attempt to deserialize a PEM encoded Ed25519 public key\n/// # Errors\n/// This function will return an error if the PEM data is invalid or has the wrong tag\npub fn deserialize_ed25519_public(bytes: \u0026[u8]) -\u003e Result\u003cVec\u003cu8\u003e, Box\u003cdyn Error\u003e\u003e {\n    let pem = pem::parse(bytes)?;\n    if pem.tag != ED25519_PUBLIC_KEY_BANNER {\n        return Err(KeyError::WrongPemTag.into())\n    }\n    Ok(pem.contents)\n}\n\nimpl NebulaCertificate {\n    /// Sign a nebula certificate with the provided private key\n    /// # Errors\n    /// This function will return an error if the certificate could not be serialized or signed.\n    pub fn sign(\u0026mut self, key: \u0026SigningKey) -\u003e Result\u003c(), Box\u003cdyn Error\u003e\u003e {\n        let mut out = Vec::new();\n        let mut writer = Writer::new(\u0026mut out);\n        self.get_raw_details().write_message(\u0026mut writer)?;\n\n        self.signature = key.sign(\u0026out).to_vec();\n        Ok(())\n    }\n\n    /// Verify the signature on a certificate with the provided public key\n    /// # Errors\n    /// This function will return an error if the certificate could not be serialized or the signature could not be checked.\n    pub fn check_signature(\u0026self, key: \u0026VerifyingKey) -\u003e Result\u003cbool, Box\u003cdyn Error\u003e\u003e {\n        let mut out = Vec::new();\n        let mut writer = Writer::new(\u0026mut out);\n        self.get_raw_details().write_message(\u0026mut writer)?;\n\n        let sig = Signature::from_slice(\u0026self.signature)?;\n\n        Ok(key.verify(\u0026out, \u0026sig).is_ok())\n    }\n\n    /// Returns true if the signature is too young or too old compared to the provided time\n    pub fn expired(\u0026self, time: SystemTime) -\u003e bool {\n        self.details.not_before \u003e time || self.details.not_after \u003c time\n    }\n\n    /// Verify will ensure a certificate is good in all respects (expiry, group membership, signature, cert blocklist, etc)\n    /// # Errors\n    /// This function will return an error if there is an error parsing the cert or the CA pool.\n    pub fn verify(\u0026self, time: SystemTime, ca_pool: \u0026NebulaCAPool) -\u003e Result\u003cCertificateValidity, Box\u003cdyn Error\u003e\u003e {\n        if ca_pool.is_blocklisted(self) {\n            return Ok(CertificateValidity::Blocklisted);\n        }\n\n        let Some(signer) = ca_pool.get_ca_for_cert(self)? else { return Ok(CertificateValidity::NotSignedByThisCAPool) };\n\n        if signer.expired(time) {\n            return Ok(CertificateValidity::RootCertExpired)\n        }\n\n        if self.expired(time) {\n            return Ok(CertificateValidity::CertExpired)\n        }\n\n        if !self.check_signature(\u0026VerifyingKey::from_bytes(\u0026signer.details.public_key)?)? {\n            return Ok(CertificateValidity::BadSignature)\n        }\n\n        Ok(self.check_root_constraints(signer))\n    }\n\n    /// Make sure that this certificate does not break any of the constraints set by the signing certificate\n    pub fn check_root_constraints(\u0026self, signer: \u0026Self) -\u003e CertificateValidity {\n        // Make sure this cert doesn't expire after the signer\n        println!(\"{:?} {:?}\", signer.details.not_before, self.details.not_before);\n        if signer.details.not_before \u003c self.details.not_before {\n            return CertificateValidity::CertExpiresAfterSigner;\n        }\n\n        // Make sure this cert doesn't come into validity before the root\n        if signer.details.not_before \u003e self.details.not_before {\n            return CertificateValidity::CertValidBeforeSigner;\n        }\n\n        // If the signer contains a limited set of groups, make sure this cert only has a subset of them\n        if !signer.details.groups.is_empty() {\n            println!(\"root groups: {:?}, child groups: {:?}\", signer.details.groups, self.details.groups);\n            for group in \u0026self.details.groups {\n                if !signer.details.groups.contains(group) {\n                    return CertificateValidity::GroupNotPresentOnSigner;\n                }\n            }\n        }\n\n        // If the signer contains a limited set of IP ranges, make sure the cert only contains a subset\n        if !signer.details.ips.is_empty() {\n            for ip in \u0026self.details.ips {\n                if !net_match(*ip, \u0026signer.details.ips) {\n                    return CertificateValidity::IPNotPresentOnSigner;\n                }\n            }\n        }\n\n        // If the signer contains a limited set of subnets, make sure the cert only contains a subset\n        if !signer.details.subnets.is_empty() {\n            for subnet in \u0026self.details.subnets {\n                if !net_match(*subnet, \u0026signer.details.subnets) {\n                    return CertificateValidity::SubnetNotPresentOnSigner;\n                }\n            }\n        }\n\n        CertificateValidity::Ok\n    }\n\n    #[allow(clippy::unwrap_used)]\n    /// Verify if the given private key corresponds to the public key contained in this certificate\n    /// # Errors\n    /// This function will return an error if either keys are invalid.\n    /// # Panics\n    /// This function, while containing calls to unwrap, has proper bounds checking and will not panic.\n    pub fn verify_private_key(\u0026self, key: \u0026[u8]) -\u003e Result\u003c(), Box\u003cdyn Error\u003e\u003e {\n        if self.details.is_ca {\n            // convert the keys\n            if key.len() != 64 {\n                return Err(\"key not 64-bytes long\".into())\n            }\n\n\n            let secret = SigningKey::from_keypair_bytes(key.try_into().unwrap())?;\n            let pub_key = secret.verifying_key().to_bytes();\n            if pub_key != self.details.public_key {\n                return Err(CertificateError::KeyMismatch.into());\n            }\n\n            return Ok(());\n        }\n\n        if key.len() != 32 {\n            return Err(\"key not 32-bytes long\".into())\n        }\n\n        let pubkey_raw = SigningKey::from_bytes(key.try_into()?).verifying_key();\n        let pubkey = pubkey_raw.as_bytes();\n\n        println!(\"{} {}\", hex::encode(pubkey), hex::encode(self.details.public_key));\n        if *pubkey != self.details.public_key {\n            return Err(CertificateError::KeyMismatch.into());\n        }\n\n        Ok(())\n    }\n\n\n    /// Get a protobuf-ready raw struct, ready for serialization\n    #[allow(clippy::expect_used)]\n    #[allow(clippy::cast_possible_wrap)]\n    /// # Panics\n    /// This function will panic if time went backwards, or if the certificate contains extremely invalid data.\n    pub fn get_raw_details(\u0026self) -\u003e RawNebulaCertificateDetails {\n\n        let mut raw = RawNebulaCertificateDetails {\n            Name: self.details.name.clone(),\n            Ips: vec![],\n            Subnets: vec![],\n            Groups: self.details.groups.iter().map(std::convert::Into::into).collect(),\n            NotBefore: self.details.not_before.duration_since(UNIX_EPOCH).expect(\"Time went backwards\").as_secs() as i64,\n            NotAfter: self.details.not_after.duration_since(UNIX_EPOCH).expect(\"Time went backwards\").as_secs() as i64,\n            PublicKey: self.details.public_key.into(),\n            IsCA: self.details.is_ca,\n            Issuer: hex::decode(\u0026self.details.issuer).expect(\"Issuer was not a hex-encoded value\"),\n        };\n\n        for ip_net in \u0026self.details.ips {\n            raw.Ips.push(ip_net.addr().into());\n            raw.Ips.push(ip_net.netmask().into());\n        }\n\n        for subnet in \u0026self.details.subnets {\n            raw.Subnets.push(subnet.addr().into());\n            raw.Subnets.push(subnet.netmask().into());\n        }\n\n        raw\n    }\n\n    /// Will serialize this cert into a protobuf byte array.\n    /// # Errors\n    /// This function will return an error if protobuf was unable to serialize the data.\n    pub fn serialize(\u0026self) -\u003e Result\u003cVec\u003cu8\u003e, Box\u003cdyn Error\u003e\u003e {\n        let raw_cert = RawNebulaCertificate {\n            Details: Some(self.get_raw_details()),\n            Signature: self.signature.clone(),\n        };\n\n        let mut out = vec![];\n        let mut writer = Writer::new(\u0026mut out);\n        raw_cert.write_message(\u0026mut writer)?;\n\n        Ok(out)\n    }\n\n    /// Will serialize this cert into a PEM byte array.\n    /// # Errors\n    /// This function will return an error if protobuf was unable to serialize the data.\n    pub fn serialize_to_pem(\u0026self) -\u003e Result\u003cVec\u003cu8\u003e, Box\u003cdyn Error\u003e\u003e {\n        let pbuf_bytes = self.serialize()?;\n\n        Ok(pem::encode(\u0026Pem {\n            tag: CERT_BANNER.to_string(),\n            contents: pbuf_bytes,\n        }).as_bytes().to_vec())\n    }\n\n    /// Get the fingerprint of this certificate\n    /// # Errors\n    /// This functiom will return an error if protobuf was unable to serialize the cert.\n    pub fn sha256sum(\u0026self) -\u003e Result\u003cString, Box\u003cdyn Error\u003e\u003e {\n        let pbuf_bytes = self.serialize()?;\n\n        let mut hasher = Sha256::new();\n        hasher.update(pbuf_bytes);\n\n        Ok(hex::encode(hasher.finalize()))\n    }\n}\n\n/// A list of possible errors that can happen validating a certificate\n#[derive(Eq, PartialEq, Debug)]\npub enum CertificateValidity {\n    /// There are no issues with this certificate\n    Ok,\n    /// This cert has been blocklisted in the given CA pool\n    Blocklisted,\n    /// The certificate that signed this cert is expired\n    RootCertExpired,\n    /// This cert is expired\n    CertExpired,\n    /// This cert's signature is invalid\n    BadSignature,\n    /// This cert was not signed by any CAs in the CA pool\n    NotSignedByThisCAPool,\n    /// This cert expires after the signer's cert expires\n    CertExpiresAfterSigner,\n    /// This cert enters validity before the signer's cert does\n    CertValidBeforeSigner,\n    /// A group present on this certificate is not present on the signer's certificate\n    GroupNotPresentOnSigner,\n    /// An IP present on this certificate is not present on the signer's certificate\n    IPNotPresentOnSigner,\n    /// A subnet on this certificate is not present on the signer's certificate\n    SubnetNotPresentOnSigner\n}\n\nfn net_match(cert_ip: Ipv4Net, root_ips: \u0026Vec\u003cIpv4Net\u003e) -\u003e bool {\n    for net in root_ips {\n        if net.contains(\u0026cert_ip) {\n            return true;\n        }\n    }\n    false\n}","traces":[{"line":87,"address":[527088],"length":1,"stats":{"Line":0},"fn_name":"fmt"},{"line":88,"address":[527115],"length":1,"stats":{"Line":0},"fn_name":null},{"line":89,"address":[527146],"length":1,"stats":{"Line":0},"fn_name":null},{"line":90,"address":[527206],"length":1,"stats":{"Line":0},"fn_name":null},{"line":91,"address":[527266],"length":1,"stats":{"Line":0},"fn_name":null},{"line":92,"address":[527326],"length":1,"stats":{"Line":0},"fn_name":null},{"line":93,"address":[527392],"length":1,"stats":{"Line":0},"fn_name":null},{"line":94,"address":[527458],"length":1,"stats":{"Line":0},"fn_name":null},{"line":95,"address":[527524],"length":1,"stats":{"Line":0},"fn_name":null},{"line":96,"address":[527587],"length":1,"stats":{"Line":0},"fn_name":null},{"line":97,"address":[527650],"length":1,"stats":{"Line":0},"fn_name":null},{"line":103,"address":[528659,527728],"length":1,"stats":{"Line":1},"fn_name":"map_cidr_pairs"},{"line":104,"address":[527771],"length":1,"stats":{"Line":1},"fn_name":null},{"line":105,"address":[528093,527808,527869],"length":1,"stats":{"Line":3},"fn_name":null},{"line":106,"address":[528654,528135],"length":1,"stats":{"Line":2},"fn_name":null},{"line":108,"address":[528006],"length":1,"stats":{"Line":1},"fn_name":null},{"line":113,"address":[530741,528688],"length":1,"stats":{"Line":1},"fn_name":"fmt"},{"line":114,"address":[528922,528721],"length":1,"stats":{"Line":1},"fn_name":null},{"line":115,"address":[528819,529100],"length":1,"stats":{"Line":1},"fn_name":null},{"line":116,"address":[529262,528969],"length":1,"stats":{"Line":1},"fn_name":null},{"line":117,"address":[529424,529132],"length":1,"stats":{"Line":1},"fn_name":null},{"line":118,"address":[529589,529294],"length":1,"stats":{"Line":1},"fn_name":null},{"line":119,"address":[529751,529456],"length":1,"stats":{"Line":1},"fn_name":null},{"line":120,"address":[529913,529621],"length":1,"stats":{"Line":1},"fn_name":null},{"line":121,"address":[530078,529783],"length":1,"stats":{"Line":1},"fn_name":null},{"line":122,"address":[530241,529945],"length":1,"stats":{"Line":1},"fn_name":null},{"line":123,"address":[530110,530348],"length":1,"stats":{"Line":1},"fn_name":null},{"line":124,"address":[530375,530687,530273],"length":1,"stats":{"Line":1},"fn_name":null},{"line":125,"address":[530846,530584],"length":1,"stats":{"Line":1},"fn_name":null},{"line":126,"address":[530785,530873,531168],"length":1,"stats":{"Line":1},"fn_name":null},{"line":127,"address":[531090,531222,531501],"length":1,"stats":{"Line":1},"fn_name":null},{"line":128,"address":[531431],"length":1,"stats":{"Line":1},"fn_name":null},{"line":136,"address":[536605,533096,531568],"length":1,"stats":{"Line":1},"fn_name":"deserialize_nebula_certificate"},{"line":137,"address":[531645],"length":1,"stats":{"Line":1},"fn_name":null},{"line":138,"address":[531839],"length":1,"stats":{"Line":1},"fn_name":null},{"line":141,"address":[531723],"length":1,"stats":{"Line":1},"fn_name":null},{"line":143,"address":[532102,531767,531953],"length":1,"stats":{"Line":2},"fn_name":null},{"line":145,"address":[532013,532506,532328],"length":1,"stats":{"Line":2},"fn_name":null},{"line":147,"address":[532653,532468],"length":1,"stats":{"Line":2},"fn_name":null},{"line":148,"address":[532690],"length":1,"stats":{"Line":1},"fn_name":null},{"line":151,"address":[532663,532797],"length":1,"stats":{"Line":2},"fn_name":null},{"line":152,"address":[532830],"length":1,"stats":{"Line":1},"fn_name":null},{"line":158,"address":[534614],"length":1,"stats":{"Line":1},"fn_name":null},{"line":159,"address":[534286],"length":1,"stats":{"Line":1},"fn_name":null},{"line":160,"address":[532807],"length":1,"stats":{"Line":1},"fn_name":null},{"line":161,"address":[532953,533217,533107,533053],"length":1,"stats":{"Line":3},"fn_name":null},{"line":162,"address":[533571,533171,533420],"length":1,"stats":{"Line":2},"fn_name":null},{"line":163,"address":[533525,533848],"length":1,"stats":{"Line":2},"fn_name":null},{"line":164,"address":[534030,533941],"length":1,"stats":{"Line":2},"fn_name":null},{"line":165,"address":[534087],"length":1,"stats":{"Line":1},"fn_name":null},{"line":166,"address":[534171],"length":1,"stats":{"Line":1},"fn_name":null},{"line":167,"address":[534190],"length":1,"stats":{"Line":1},"fn_name":null},{"line":168,"address":[534201],"length":1,"stats":{"Line":1},"fn_name":null},{"line":170,"address":[534517],"length":1,"stats":{"Line":1},"fn_name":null},{"line":174,"address":[534689],"length":1,"stats":{"Line":1},"fn_name":null},{"line":176,"address":[534871],"length":1,"stats":{"Line":1},"fn_name":null},{"line":177,"address":[534972],"length":1,"stats":{"Line":1},"fn_name":null},{"line":182,"address":[535933],"length":1,"stats":{"Line":1},"fn_name":null},{"line":192,"address":[536640],"length":1,"stats":{"Line":0},"fn_name":"fmt"},{"line":194,"address":[536658],"length":1,"stats":{"Line":0},"fn_name":null},{"line":204,"address":[537197,536720],"length":1,"stats":{"Line":1},"fn_name":"deserialize_nebula_certificate_from_pem"},{"line":205,"address":[536753,536917],"length":1,"stats":{"Line":2},"fn_name":null},{"line":206,"address":[536891,537049],"length":1,"stats":{"Line":2},"fn_name":null},{"line":207,"address":[537081],"length":1,"stats":{"Line":0},"fn_name":null},{"line":209,"address":[537174,537055],"length":1,"stats":{"Line":2},"fn_name":null},{"line":213,"address":[537443,537232],"length":1,"stats":{"Line":1},"fn_name":"serialize_x25519_private"},{"line":214,"address":[537582,537512,537370],"length":1,"stats":{"Line":3},"fn_name":null},{"line":215,"address":[537275],"length":1,"stats":{"Line":1},"fn_name":null},{"line":216,"address":[537310],"length":1,"stats":{"Line":1},"fn_name":null},{"line":217,"address":[537329],"length":1,"stats":{"Line":0},"fn_name":null},{"line":221,"address":[537859,537648],"length":1,"stats":{"Line":1},"fn_name":"serialize_x25519_public"},{"line":222,"address":[537786,537928,537998],"length":1,"stats":{"Line":3},"fn_name":null},{"line":223,"address":[537691],"length":1,"stats":{"Line":1},"fn_name":null},{"line":224,"address":[537726],"length":1,"stats":{"Line":1},"fn_name":null},{"line":225,"address":[537745],"length":1,"stats":{"Line":0},"fn_name":null},{"line":231,"address":[538562,538064],"length":1,"stats":{"Line":1},"fn_name":"deserialize_x25519_private"},{"line":232,"address":[538258,538097],"length":1,"stats":{"Line":2},"fn_name":null},{"line":233,"address":[538232,538390],"length":1,"stats":{"Line":2},"fn_name":null},{"line":234,"address":[538499],"length":1,"stats":{"Line":0},"fn_name":null},{"line":236,"address":[538401],"length":1,"stats":{"Line":1},"fn_name":null},{"line":242,"address":[539090,538592],"length":1,"stats":{"Line":1},"fn_name":"deserialize_x25519_public"},{"line":243,"address":[538786,538625],"length":1,"stats":{"Line":2},"fn_name":null},{"line":244,"address":[538918,538760],"length":1,"stats":{"Line":2},"fn_name":null},{"line":245,"address":[539027],"length":1,"stats":{"Line":0},"fn_name":null},{"line":247,"address":[538929],"length":1,"stats":{"Line":1},"fn_name":null},{"line":251,"address":[539331,539120],"length":1,"stats":{"Line":1},"fn_name":"serialize_ed25519_private"},{"line":252,"address":[539400,539470,539258],"length":1,"stats":{"Line":3},"fn_name":null},{"line":253,"address":[539163],"length":1,"stats":{"Line":1},"fn_name":null},{"line":254,"address":[539198],"length":1,"stats":{"Line":1},"fn_name":null},{"line":255,"address":[539217],"length":1,"stats":{"Line":0},"fn_name":null},{"line":259,"address":[539536,539747],"length":1,"stats":{"Line":1},"fn_name":"serialize_ed25519_public"},{"line":260,"address":[539674,539816,539886],"length":1,"stats":{"Line":3},"fn_name":null},{"line":261,"address":[539579],"length":1,"stats":{"Line":1},"fn_name":null},{"line":262,"address":[539614],"length":1,"stats":{"Line":1},"fn_name":null},{"line":263,"address":[539633],"length":1,"stats":{"Line":0},"fn_name":null},{"line":269,"address":[539952,540450],"length":1,"stats":{"Line":1},"fn_name":"deserialize_ed25519_private"},{"line":270,"address":[539985,540146],"length":1,"stats":{"Line":2},"fn_name":null},{"line":271,"address":[540120,540278],"length":1,"stats":{"Line":2},"fn_name":null},{"line":272,"address":[540387],"length":1,"stats":{"Line":0},"fn_name":null},{"line":274,"address":[540289],"length":1,"stats":{"Line":1},"fn_name":null},{"line":280,"address":[540480,540978],"length":1,"stats":{"Line":1},"fn_name":"deserialize_ed25519_public"},{"line":281,"address":[540513,540674],"length":1,"stats":{"Line":2},"fn_name":null},{"line":282,"address":[540648,540806],"length":1,"stats":{"Line":2},"fn_name":null},{"line":283,"address":[540915],"length":1,"stats":{"Line":0},"fn_name":null},{"line":285,"address":[540817],"length":1,"stats":{"Line":1},"fn_name":null},{"line":292,"address":[541008,541428,541730],"length":1,"stats":{"Line":1},"fn_name":"sign"},{"line":293,"address":[541041],"length":1,"stats":{"Line":1},"fn_name":null},{"line":294,"address":[541065,541128],"length":1,"stats":{"Line":2},"fn_name":null},{"line":295,"address":[541141],"length":1,"stats":{"Line":1},"fn_name":null},{"line":297,"address":[541468],"length":1,"stats":{"Line":1},"fn_name":null},{"line":298,"address":[541705],"length":1,"stats":{"Line":1},"fn_name":null},{"line":304,"address":[542610,541760,542165],"length":1,"stats":{"Line":1},"fn_name":"check_signature"},{"line":305,"address":[541803],"length":1,"stats":{"Line":1},"fn_name":null},{"line":306,"address":[541890,541827],"length":1,"stats":{"Line":2},"fn_name":null},{"line":307,"address":[541903],"length":1,"stats":{"Line":1},"fn_name":null},{"line":309,"address":[542458,542197],"length":1,"stats":{"Line":2},"fn_name":null},{"line":311,"address":[542672,542427,542564],"length":1,"stats":{"Line":3},"fn_name":null},{"line":315,"address":[542768],"length":1,"stats":{"Line":1},"fn_name":"expired"},{"line":316,"address":[542790],"length":1,"stats":{"Line":1},"fn_name":null},{"line":322,"address":[542864],"length":1,"stats":{"Line":1},"fn_name":"verify"},{"line":323,"address":[542939],"length":1,"stats":{"Line":1},"fn_name":null},{"line":324,"address":[543016],"length":1,"stats":{"Line":1},"fn_name":null},{"line":327,"address":[543173,543040,542958,543140],"length":1,"stats":{"Line":3},"fn_name":null},{"line":329,"address":[543157],"length":1,"stats":{"Line":1},"fn_name":null},{"line":330,"address":[543219],"length":1,"stats":{"Line":1},"fn_name":null},{"line":333,"address":[543203],"length":1,"stats":{"Line":1},"fn_name":null},{"line":334,"address":[543295],"length":1,"stats":{"Line":1},"fn_name":null},{"line":337,"address":[543487,543311,543239],"length":1,"stats":{"Line":3},"fn_name":null},{"line":338,"address":[543597],"length":1,"stats":{"Line":0},"fn_name":null},{"line":341,"address":[543565],"length":1,"stats":{"Line":1},"fn_name":null},{"line":345,"address":[543616],"length":1,"stats":{"Line":1},"fn_name":"check_root_constraints"},{"line":347,"address":[543662],"length":1,"stats":{"Line":1},"fn_name":null},{"line":348,"address":[543788],"length":1,"stats":{"Line":1},"fn_name":null},{"line":349,"address":[543834],"length":1,"stats":{"Line":0},"fn_name":null},{"line":353,"address":[543815],"length":1,"stats":{"Line":1},"fn_name":null},{"line":354,"address":[543876],"length":1,"stats":{"Line":0},"fn_name":null},{"line":358,"address":[543856],"length":1,"stats":{"Line":1},"fn_name":null},{"line":359,"address":[543917],"length":1,"stats":{"Line":1},"fn_name":null},{"line":360,"address":[544056],"length":1,"stats":{"Line":1},"fn_name":null},{"line":361,"address":[544164],"length":1,"stats":{"Line":1},"fn_name":null},{"line":362,"address":[544200],"length":1,"stats":{"Line":1},"fn_name":null},{"line":368,"address":[543888],"length":1,"stats":{"Line":1},"fn_name":null},{"line":369,"address":[544244],"length":1,"stats":{"Line":1},"fn_name":null},{"line":370,"address":[544341],"length":1,"stats":{"Line":1},"fn_name":null},{"line":371,"address":[544404],"length":1,"stats":{"Line":1},"fn_name":null},{"line":377,"address":[544215],"length":1,"stats":{"Line":1},"fn_name":null},{"line":378,"address":[544429],"length":1,"stats":{"Line":1},"fn_name":null},{"line":379,"address":[544526],"length":1,"stats":{"Line":1},"fn_name":null},{"line":380,"address":[544589],"length":1,"stats":{"Line":1},"fn_name":null},{"line":385,"address":[544414],"length":1,"stats":{"Line":1},"fn_name":null},{"line":394,"address":[545205,544608],"length":1,"stats":{"Line":1},"fn_name":"verify_private_key"},{"line":395,"address":[544663],"length":1,"stats":{"Line":1},"fn_name":null},{"line":397,"address":[544703],"length":1,"stats":{"Line":1},"fn_name":null},{"line":398,"address":[544799],"length":1,"stats":{"Line":0},"fn_name":null},{"line":402,"address":[544856,544725,544961],"length":1,"stats":{"Line":2},"fn_name":null},{"line":403,"address":[545086,544942],"length":1,"stats":{"Line":2},"fn_name":null},{"line":404,"address":[545109],"length":1,"stats":{"Line":1},"fn_name":null},{"line":405,"address":[545144],"length":1,"stats":{"Line":1},"fn_name":null},{"line":408,"address":[545130],"length":1,"stats":{"Line":1},"fn_name":null},{"line":411,"address":[544680],"length":1,"stats":{"Line":1},"fn_name":null},{"line":412,"address":[545319],"length":1,"stats":{"Line":0},"fn_name":null},{"line":415,"address":[545357,545266],"length":1,"stats":{"Line":2},"fn_name":null},{"line":416,"address":[545517],"length":1,"stats":{"Line":1},"fn_name":null},{"line":418,"address":[545554],"length":1,"stats":{"Line":1},"fn_name":null},{"line":419,"address":[545934],"length":1,"stats":{"Line":1},"fn_name":null},{"line":420,"address":[545960],"length":1,"stats":{"Line":1},"fn_name":null},{"line":423,"address":[545943],"length":1,"stats":{"Line":1},"fn_name":null},{"line":432,"address":[547137,546016],"length":1,"stats":{"Line":1},"fn_name":"get_raw_details"},{"line":435,"address":[546055],"length":1,"stats":{"Line":1},"fn_name":null},{"line":436,"address":[546084],"length":1,"stats":{"Line":1},"fn_name":null},{"line":437,"address":[546143],"length":1,"stats":{"Line":1},"fn_name":null},{"line":438,"address":[546290,546199],"length":1,"stats":{"Line":2},"fn_name":null},{"line":439,"address":[546391,546471],"length":1,"stats":{"Line":2},"fn_name":null},{"line":440,"address":[546581],"length":1,"stats":{"Line":1},"fn_name":null},{"line":441,"address":[546727],"length":1,"stats":{"Line":1},"fn_name":null},{"line":442,"address":[546781],"length":1,"stats":{"Line":1},"fn_name":null},{"line":443,"address":[546860,546794],"length":1,"stats":{"Line":2},"fn_name":null},{"line":446,"address":[547110,547344,547216],"length":1,"stats":{"Line":3},"fn_name":null},{"line":447,"address":[547365],"length":1,"stats":{"Line":1},"fn_name":null},{"line":448,"address":[547465],"length":1,"stats":{"Line":1},"fn_name":null},{"line":451,"address":[547312,547567,547673],"length":1,"stats":{"Line":3},"fn_name":null},{"line":452,"address":[547694],"length":1,"stats":{"Line":1},"fn_name":null},{"line":453,"address":[547794],"length":1,"stats":{"Line":1},"fn_name":null},{"line":462,"address":[547888,548103],"length":1,"stats":{"Line":1},"fn_name":"serialize"},{"line":464,"address":[547931],"length":1,"stats":{"Line":1},"fn_name":null},{"line":465,"address":[547968],"length":1,"stats":{"Line":1},"fn_name":null},{"line":468,"address":[548084],"length":1,"stats":{"Line":1},"fn_name":null},{"line":469,"address":[548229,548171],"length":1,"stats":{"Line":2},"fn_name":null},{"line":470,"address":[548429,548258],"length":1,"stats":{"Line":1},"fn_name":null},{"line":472,"address":[548318],"length":1,"stats":{"Line":1},"fn_name":null},{"line":478,"address":[548592,548943],"length":1,"stats":{"Line":1},"fn_name":"serialize_to_pem"},{"line":479,"address":[548734,548617],"length":1,"stats":{"Line":1},"fn_name":null},{"line":481,"address":[548852,549018,549084],"length":1,"stats":{"Line":3},"fn_name":null},{"line":482,"address":[548702],"length":1,"stats":{"Line":1},"fn_name":null},{"line":483,"address":[548826],"length":1,"stats":{"Line":1},"fn_name":null},{"line":490,"address":[549728,549184,549697],"length":1,"stats":{"Line":1},"fn_name":"sha256sum"},{"line":491,"address":[549208,549322],"length":1,"stats":{"Line":1},"fn_name":null},{"line":493,"address":[549311],"length":1,"stats":{"Line":1},"fn_name":null},{"line":494,"address":[549422],"length":1,"stats":{"Line":1},"fn_name":null},{"line":496,"address":[549479],"length":1,"stats":{"Line":1},"fn_name":null},{"line":527,"address":[549744],"length":1,"stats":{"Line":1},"fn_name":"net_match"},{"line":528,"address":[549858,549794],"length":1,"stats":{"Line":2},"fn_name":null},{"line":529,"address":[549868],"length":1,"stats":{"Line":1},"fn_name":null},{"line":530,"address":[549885],"length":1,"stats":{"Line":1},"fn_name":null},{"line":533,"address":[549851],"length":1,"stats":{"Line":1},"fn_name":null}],"covered":178,"coverable":205},{"path":["/","home","core","prj","e3t","trifid","trifid-pki","src","cert_codec.rs"],"content":"// Automatically generated rust module for 'cert_codec.proto' file\n\n#![allow(non_snake_case)]\n#![allow(non_upper_case_globals)]\n#![allow(non_camel_case_types)]\n#![allow(unused_imports)]\n#![allow(unknown_lints)]\n#![allow(clippy::all)]\n#![cfg_attr(rustfmt, rustfmt_skip)]\n#![allow(clippy::pedantic)]\n\nuse quick_protobuf::{MessageInfo, MessageRead, MessageWrite, BytesReader, Writer, WriterBackend, Result};\nuse quick_protobuf::sizeofs::*;\nuse super::*;\n\n#[allow(clippy::derive_partial_eq_without_eq)]\n#[derive(Debug, Default, PartialEq, Clone)]\npub struct RawNebulaCertificate {\n    pub Details: Option\u003ccert_codec::RawNebulaCertificateDetails\u003e,\n    pub Signature: Vec\u003cu8\u003e,\n}\n\nimpl\u003c'a\u003e MessageRead\u003c'a\u003e for RawNebulaCertificate {\n    fn from_reader(r: \u0026mut BytesReader, bytes: \u0026'a [u8]) -\u003e Result\u003cSelf\u003e {\n        let mut msg = Self::default();\n        while !r.is_eof() {\n            match r.next_tag(bytes) {\n                Ok(10) =\u003e msg.Details = Some(r.read_message::\u003ccert_codec::RawNebulaCertificateDetails\u003e(bytes)?),\n                Ok(18) =\u003e msg.Signature = r.read_bytes(bytes)?.to_owned(),\n                Ok(t) =\u003e { r.read_unknown(bytes, t)?; }\n                Err(e) =\u003e return Err(e),\n            }\n        }\n        Ok(msg)\n    }\n}\n\nimpl MessageWrite for RawNebulaCertificate {\n    fn get_size(\u0026self) -\u003e usize {\n        0\n        + self.Details.as_ref().map_or(0, |m| 1 + sizeof_len((m).get_size()))\n        + if self.Signature.is_empty() { 0 } else { 1 + sizeof_len((\u0026self.Signature).len()) }\n    }\n\n    fn write_message\u003cW: WriterBackend\u003e(\u0026self, w: \u0026mut Writer\u003cW\u003e) -\u003e Result\u003c()\u003e {\n        if let Some(ref s) = self.Details { w.write_with_tag(10, |w| w.write_message(s))?; }\n        if !self.Signature.is_empty() { w.write_with_tag(18, |w| w.write_bytes(\u0026**\u0026self.Signature))?; }\n        Ok(())\n    }\n}\n\n#[allow(clippy::derive_partial_eq_without_eq)]\n#[derive(Debug, Default, PartialEq, Clone)]\npub struct RawNebulaCertificateDetails {\n    pub Name: String,\n    pub Ips: Vec\u003cu32\u003e,\n    pub Subnets: Vec\u003cu32\u003e,\n    pub Groups: Vec\u003cString\u003e,\n    pub NotBefore: i64,\n    pub NotAfter: i64,\n    pub PublicKey: Vec\u003cu8\u003e,\n    pub IsCA: bool,\n    pub Issuer: Vec\u003cu8\u003e,\n}\n\nimpl\u003c'a\u003e MessageRead\u003c'a\u003e for RawNebulaCertificateDetails {\n    fn from_reader(r: \u0026mut BytesReader, bytes: \u0026'a [u8]) -\u003e Result\u003cSelf\u003e {\n        let mut msg = Self::default();\n        while !r.is_eof() {\n            match r.next_tag(bytes) {\n                Ok(10) =\u003e msg.Name = r.read_string(bytes)?.to_owned(),\n                Ok(18) =\u003e msg.Ips = r.read_packed(bytes, |r, bytes| Ok(r.read_uint32(bytes)?))?,\n                Ok(26) =\u003e msg.Subnets = r.read_packed(bytes, |r, bytes| Ok(r.read_uint32(bytes)?))?,\n                Ok(34) =\u003e msg.Groups.push(r.read_string(bytes)?.to_owned()),\n                Ok(40) =\u003e msg.NotBefore = r.read_int64(bytes)?,\n                Ok(48) =\u003e msg.NotAfter = r.read_int64(bytes)?,\n                Ok(58) =\u003e msg.PublicKey = r.read_bytes(bytes)?.to_owned(),\n                Ok(64) =\u003e msg.IsCA = r.read_bool(bytes)?,\n                Ok(74) =\u003e msg.Issuer = r.read_bytes(bytes)?.to_owned(),\n                Ok(t) =\u003e { r.read_unknown(bytes, t)?; }\n                Err(e) =\u003e return Err(e),\n            }\n        }\n        Ok(msg)\n    }\n}\n\nimpl MessageWrite for RawNebulaCertificateDetails {\n    fn get_size(\u0026self) -\u003e usize {\n        0\n        + if self.Name == String::default() { 0 } else { 1 + sizeof_len((\u0026self.Name).len()) }\n        + if self.Ips.is_empty() { 0 } else { 1 + sizeof_len(self.Ips.iter().map(|s| sizeof_varint(*(s) as u64)).sum::\u003cusize\u003e()) }\n        + if self.Subnets.is_empty() { 0 } else { 1 + sizeof_len(self.Subnets.iter().map(|s| sizeof_varint(*(s) as u64)).sum::\u003cusize\u003e()) }\n        + self.Groups.iter().map(|s| 1 + sizeof_len((s).len())).sum::\u003cusize\u003e()\n        + if self.NotBefore == 0i64 { 0 } else { 1 + sizeof_varint(*(\u0026self.NotBefore) as u64) }\n        + if self.NotAfter == 0i64 { 0 } else { 1 + sizeof_varint(*(\u0026self.NotAfter) as u64) }\n        + if self.PublicKey.is_empty() { 0 } else { 1 + sizeof_len((\u0026self.PublicKey).len()) }\n        + if self.IsCA == false { 0 } else { 1 + sizeof_varint(*(\u0026self.IsCA) as u64) }\n        + if self.Issuer.is_empty() { 0 } else { 1 + sizeof_len((\u0026self.Issuer).len()) }\n    }\n\n    fn write_message\u003cW: WriterBackend\u003e(\u0026self, w: \u0026mut Writer\u003cW\u003e) -\u003e Result\u003c()\u003e {\n        if self.Name != String::default() { w.write_with_tag(10, |w| w.write_string(\u0026**\u0026self.Name))?; }\n        w.write_packed_with_tag(18, \u0026self.Ips, |w, m| w.write_uint32(*m), \u0026|m| sizeof_varint(*(m) as u64))?;\n        w.write_packed_with_tag(26, \u0026self.Subnets, |w, m| w.write_uint32(*m), \u0026|m| sizeof_varint(*(m) as u64))?;\n        for s in \u0026self.Groups { w.write_with_tag(34, |w| w.write_string(\u0026**s))?; }\n        if self.NotBefore != 0i64 { w.write_with_tag(40, |w| w.write_int64(*\u0026self.NotBefore))?; }\n        if self.NotAfter != 0i64 { w.write_with_tag(48, |w| w.write_int64(*\u0026self.NotAfter))?; }\n        if !self.PublicKey.is_empty() { w.write_with_tag(58, |w| w.write_bytes(\u0026**\u0026self.PublicKey))?; }\n        if self.IsCA != false { w.write_with_tag(64, |w| w.write_bool(*\u0026self.IsCA))?; }\n        if !self.Issuer.is_empty() { w.write_with_tag(74, |w| w.write_bytes(\u0026**\u0026self.Issuer))?; }\n        Ok(())\n    }\n}\n\n","traces":[],"covered":0,"coverable":0},{"path":["/","home","core","prj","e3t","trifid","trifid-pki","src","lib.rs"],"content":"//! # trifid-pki\n//! trifid-pki is a crate for interacting with the Nebula PKI system. It was created to prevent the need to make constant CLI calls for signing operations in Nebula.\n//! It is designed to be interoperable with the original Go implementation and as such has some oddities with key management to ensure compatability.\n//!\n//! This crate has not received any format security audits, however the underlying crates used for actual cryptographic operations (ed25519-dalek and curve25519-dalek) have been audited with no major issues.\n\n#![warn(clippy::pedantic)]\n#![warn(clippy::nursery)]\n#![deny(clippy::unwrap_used)]\n#![deny(clippy::expect_used)]\n#![deny(missing_docs)]\n#![deny(clippy::missing_errors_doc)]\n#![deny(clippy::missing_panics_doc)]\n#![deny(clippy::missing_safety_doc)]\n#![allow(clippy::must_use_candidate)]\n#![allow(clippy::too_many_lines)]\n#![allow(clippy::module_name_repetitions)]\n\n\nextern crate core;\n\npub mod ca;\npub mod cert;\n#[cfg(not(tarpaulin_include))]\npub(crate) mod cert_codec;\n#[cfg(test)]\n#[macro_use]\npub mod test;","traces":[],"covered":0,"coverable":0},{"path":["/","home","core","prj","e3t","trifid","trifid-pki","src","test.rs"],"content":"#![allow(clippy::unwrap_used)]\n#![allow(clippy::expect_used)]\n\nuse crate::netmask;\nuse std::net::Ipv4Addr;\nuse std::ops::{Add, Sub};\nuse std::time::{Duration, SystemTime, SystemTimeError, UNIX_EPOCH};\nuse ipnet::Ipv4Net;\nuse crate::cert::{CertificateValidity, deserialize_ed25519_private, deserialize_ed25519_public, deserialize_nebula_certificate, deserialize_nebula_certificate_from_pem, deserialize_x25519_private, deserialize_x25519_public, NebulaCertificate, NebulaCertificateDetails, serialize_ed25519_private, serialize_ed25519_public, serialize_x25519_private, serialize_x25519_public};\nuse std::str::FromStr;\nuse ed25519_dalek::{SigningKey, VerifyingKey};\nuse quick_protobuf::{MessageWrite, Writer};\nuse rand::rngs::OsRng;\nuse crate::ca::{NebulaCAPool};\nuse crate::cert_codec::{RawNebulaCertificate, RawNebulaCertificateDetails};\n\n/// This is a cert that we (e3team) actually use in production, and it's a known-good certificate.\npub const KNOWN_GOOD_CERT: \u0026[u8; 258] = b\"-----BEGIN NEBULA CERTIFICATE-----\\nCkkKF2UzdGVhbSBJbnRlcm5hbCBOZXR3b3JrKJWev5wGMJWFxKsGOiCvpwoHyKY5\\n8Q5+2XxDjtoCf/zlNY/EUdB8bwXQSwEo50ABEkB0Dx76lkMqc3IyH5+ml2dKjTyv\\nB4Jiw6x3abf5YZcf8rDuVEgQpvFdJmo3xJyIb3C9vKZ6kXsUxjw6s1JdWgkA\\n-----END NEBULA CERTIFICATE-----\";\n\n#[test]\nfn certificate_serialization() {\n    let before = round_systime_to_secs(SystemTime::now() - Duration::from_secs(60)).unwrap();\n    let after = round_systime_to_secs(SystemTime::now() + Duration::from_secs(60)).unwrap();\n    let pub_key = b\"1234567890abcedfghij1234567890ab\";\n\n    let cert = NebulaCertificate {\n        details: NebulaCertificateDetails {\n            name: \"testing\".to_string(),\n            ips: vec![\n                netmask!(\"10.1.1.1\", \"255.255.255.0\"),\n                netmask!(\"10.1.1.2\", \"255.255.0.0\"),\n                netmask!(\"10.1.1.3\", \"255.0.0.0\")\n            ],\n            subnets: vec![\n                netmask!(\"9.1.1.1\", \"255.255.255.128\"),\n                netmask!(\"9.1.1.2\", \"255.255.255.0\"),\n                netmask!(\"9.1.1.3\", \"255.255.0.0\")\n            ],\n            groups: vec![\"test-group1\".to_string(), \"test-group2\".to_string(), \"test-group3\".to_string()],\n            not_before: before,\n            not_after: after,\n            public_key: *pub_key,\n            is_ca: false,\n            issuer: \"1234567890abcedfabcd1234567890ab\".to_string(),\n        },\n        signature: b\"1234567890abcedfghij1234567890ab\".to_vec(),\n    };\n\n    let bytes = cert.serialize().unwrap();\n\n    let deserialized = deserialize_nebula_certificate(\u0026bytes).unwrap();\n\n    assert_eq!(cert.signature, deserialized.signature);\n    assert_eq!(cert.details.name, deserialized.details.name);\n    assert_eq!(cert.details.not_before, deserialized.details.not_before);\n    assert_eq!(cert.details.not_after, deserialized.details.not_after);\n    assert_eq!(cert.details.public_key, deserialized.details.public_key);\n    assert_eq!(cert.details.is_ca, deserialized.details.is_ca);\n\n    assert_eq!(cert.details.ips.len(), deserialized.details.ips.len());\n    for item in \u0026cert.details.ips {\n        assert!(deserialized.details.ips.contains(item), \"deserialized does not contain from source\");\n    }\n\n    assert_eq!(cert.details.subnets.len(), deserialized.details.subnets.len());\n    for item in \u0026cert.details.subnets {\n        assert!(deserialized.details.subnets.contains(item), \"deserialized does not contain from source\");\n    }\n\n    assert_eq!(cert.details.groups.len(), deserialized.details.groups.len());\n    for item in \u0026cert.details.groups {\n        assert!(deserialized.details.groups.contains(item), \"deserialized does not contain from source\");\n    }\n}\n\n#[test]\nfn certificate_serialization_pem() {\n    let before = round_systime_to_secs(SystemTime::now() - Duration::from_secs(60)).unwrap();\n    let after = round_systime_to_secs(SystemTime::now() + Duration::from_secs(60)).unwrap();\n    let pub_key = b\"1234567890abcedfghij1234567890ab\";\n\n    let cert = NebulaCertificate {\n        details: NebulaCertificateDetails {\n            name: \"testing\".to_string(),\n            ips: vec![\n                netmask!(\"10.1.1.1\", \"255.255.255.0\"),\n                netmask!(\"10.1.1.2\", \"255.255.0.0\"),\n                netmask!(\"10.1.1.3\", \"255.0.0.0\")\n            ],\n            subnets: vec![\n                netmask!(\"9.1.1.1\", \"255.255.255.128\"),\n                netmask!(\"9.1.1.2\", \"255.255.255.0\"),\n                netmask!(\"9.1.1.3\", \"255.255.0.0\")\n            ],\n            groups: vec![\"test-group1\".to_string(), \"test-group2\".to_string(), \"test-group3\".to_string()],\n            not_before: before,\n            not_after: after,\n            public_key: *pub_key,\n            is_ca: false,\n            issuer: \"1234567890abcedfabcd1234567890ab\".to_string(),\n        },\n        signature: b\"1234567890abcedfghij1234567890ab\".to_vec(),\n    };\n\n    let bytes = cert.serialize_to_pem().unwrap();\n\n    let deserialized = deserialize_nebula_certificate_from_pem(\u0026bytes).unwrap();\n\n    assert_eq!(cert.signature, deserialized.signature);\n    assert_eq!(cert.details.name, deserialized.details.name);\n    assert_eq!(cert.details.not_before, deserialized.details.not_before);\n    assert_eq!(cert.details.not_after, deserialized.details.not_after);\n    assert_eq!(cert.details.public_key, deserialized.details.public_key);\n    assert_eq!(cert.details.is_ca, deserialized.details.is_ca);\n\n    assert_eq!(cert.details.ips.len(), deserialized.details.ips.len());\n    for item in \u0026cert.details.ips {\n        assert!(deserialized.details.ips.contains(item), \"deserialized does not contain from source\");\n    }\n\n    assert_eq!(cert.details.subnets.len(), deserialized.details.subnets.len());\n    for item in \u0026cert.details.subnets {\n        assert!(deserialized.details.subnets.contains(item), \"deserialized does not contain from source\");\n    }\n\n    assert_eq!(cert.details.groups.len(), deserialized.details.groups.len());\n    for item in \u0026cert.details.groups {\n        assert!(deserialized.details.groups.contains(item), \"deserialized does not contain from source\");\n    }\n}\n\n#[test]\nfn cert_signing() {\n    let before = round_systime_to_secs(SystemTime::now() - Duration::from_secs(60)).unwrap();\n    let after = round_systime_to_secs(SystemTime::now() + Duration::from_secs(60)).unwrap();\n    let pub_key = b\"1234567890abcedfghij1234567890ab\";\n\n    let mut cert = NebulaCertificate {\n        details: NebulaCertificateDetails {\n            name: \"testing\".to_string(),\n            ips: vec![\n                netmask!(\"10.1.1.1\", \"255.255.255.0\"),\n                netmask!(\"10.1.1.2\", \"255.255.0.0\"),\n                netmask!(\"10.1.1.3\", \"255.0.0.0\")\n            ],\n            subnets: vec![\n                netmask!(\"9.1.1.1\", \"255.255.255.128\"),\n                netmask!(\"9.1.1.2\", \"255.255.255.0\"),\n                netmask!(\"9.1.1.3\", \"255.255.0.0\")\n            ],\n            groups: vec![\"test-group1\".to_string(), \"test-group2\".to_string(), \"test-group3\".to_string()],\n            not_before: before,\n            not_after: after,\n            public_key: *pub_key,\n            is_ca: false,\n            issuer: \"1234567890abcedfabcd1234567890ab\".to_string(),\n        },\n        signature: b\"1234567890abcedfghij1234567890ab\".to_vec(),\n    };\n\n    let mut csprng = OsRng;\n    let key = SigningKey::generate(\u0026mut csprng);\n\n    assert!(cert.check_signature(\u0026key.verifying_key()).is_err());\n    cert.sign(\u0026key).unwrap();\n    assert!(cert.check_signature(\u0026key.verifying_key()).unwrap());\n}\n\n#[test]\nfn cert_expiry() {\n    let cert = NebulaCertificate {\n        details: NebulaCertificateDetails {\n            name: String::new(),\n            ips: vec![],\n            subnets: vec![],\n            groups: vec![],\n            not_before: SystemTime::now().sub(Duration::from_secs(60)),\n            not_after: SystemTime::now().add(Duration::from_secs(60)),\n            public_key: [0u8; 32],\n            is_ca: false,\n            issuer: String::new(),\n        },\n        signature: vec![],\n    };\n\n    assert!(cert.expired(SystemTime::now().add(Duration::from_secs(60 * 60 * 60))));\n    assert!(cert.expired(SystemTime::now().sub(Duration::from_secs(60 * 60 * 60))));\n    assert!(!cert.expired(SystemTime::now()));\n}\n\n#[test]\nfn cert_display() {\n    let cert = NebulaCertificate {\n        details: NebulaCertificateDetails {\n            name: String::new(),\n            ips: vec![],\n            subnets: vec![],\n            groups: vec![],\n            not_before: SystemTime::now().sub(Duration::from_secs(60)),\n            not_after: SystemTime::now().add(Duration::from_secs(60)),\n            public_key: [0u8; 32],\n            is_ca: false,\n            issuer: String::new(),\n        },\n        signature: vec![],\n    };\n    println!(\"{cert}\");\n}\n\n#[test]\n#[should_panic]\nfn cert_deserialize_empty_bytes() {\n    deserialize_nebula_certificate(\u0026[]).unwrap();\n}\n\n#[test]\nfn cert_deserialize_unpaired_ips() {\n    let broken_cert = RawNebulaCertificate {\n        Details: Some(RawNebulaCertificateDetails {\n            Name: String::new(),\n            Ips: vec![0],\n            Subnets: vec![],\n            Groups: vec![],\n            NotBefore: 0,\n            NotAfter: 0,\n            PublicKey: vec![],\n            IsCA: false,\n            Issuer: vec![],\n        }),\n        Signature: vec![],\n    };\n    let mut bytes = vec![];\n    let mut writer = Writer::new(\u0026mut bytes);\n    broken_cert.write_message(\u0026mut writer).unwrap();\n\n    deserialize_nebula_certificate(\u0026bytes).unwrap_err();\n}\n\n#[test]\nfn cert_deserialize_unpaired_subnets() {\n    let broken_cert = RawNebulaCertificate {\n        Details: Some(RawNebulaCertificateDetails {\n            Name: String::new(),\n            Ips: vec![],\n            Subnets: vec![0],\n            Groups: vec![],\n            NotBefore: 0,\n            NotAfter: 0,\n            PublicKey: vec![],\n            IsCA: false,\n            Issuer: vec![],\n        }),\n        Signature: vec![],\n    };\n    let mut bytes = vec![];\n    let mut writer = Writer::new(\u0026mut bytes);\n    broken_cert.write_message(\u0026mut writer).unwrap();\n\n    deserialize_nebula_certificate(\u0026bytes).unwrap_err();\n}\n\n#[test]\nfn cert_deserialize_wrong_pubkey_len() {\n    let broken_cert = RawNebulaCertificate {\n        Details: Some(RawNebulaCertificateDetails {\n            Name: String::new(),\n            Ips: vec![],\n            Subnets: vec![],\n            Groups: vec![],\n            NotBefore: 0,\n            NotAfter: 0,\n            PublicKey: vec![0u8; 31],\n            IsCA: false,\n            Issuer: vec![],\n        }),\n        Signature: vec![],\n    };\n    let mut bytes = vec![];\n    let mut writer = Writer::new(\u0026mut bytes);\n    broken_cert.write_message(\u0026mut writer).unwrap();\n\n    deserialize_nebula_certificate(\u0026bytes).unwrap_err();\n\n    assert!(deserialize_nebula_certificate_from_pem(\u0026[0u8; 32]).is_err());\n}\n\n#[test]\nfn x25519_serialization() {\n    let bytes = [0u8; 32];\n    assert_eq!(deserialize_x25519_private(\u0026serialize_x25519_private(\u0026bytes)).unwrap(), bytes);\n    assert!(deserialize_x25519_private(\u0026[0u8; 32]).is_err());\n    assert_eq!(deserialize_x25519_public(\u0026serialize_x25519_public(\u0026bytes)).unwrap(), bytes);\n    assert!(deserialize_x25519_public(\u0026[0u8; 32]).is_err());\n}\n\n#[test]\nfn ed25519_serialization() {\n    let bytes = [0u8; 32];\n    assert_eq!(deserialize_ed25519_private(\u0026serialize_ed25519_private(\u0026bytes)).unwrap(), bytes);\n    assert!(deserialize_ed25519_private(\u0026[0u8; 32]).is_err());\n    assert_eq!(deserialize_ed25519_public(\u0026serialize_ed25519_public(\u0026bytes)).unwrap(), bytes);\n    assert!(deserialize_ed25519_public(\u0026[0u8; 32]).is_err());\n}\n\n#[test]\nfn cert_verify() {\n    let (ca_cert, ca_key, _ca_pub) = test_ca_cert(round_systime_to_secs(SystemTime::now()).unwrap(), round_systime_to_secs(SystemTime::now() + Duration::from_secs(60 * 60 * 10)).unwrap(), vec![], vec![], vec![\"groupa\".to_string()]);\n\n    let (cert, _, _) = test_cert(\u0026ca_cert, \u0026ca_key, SystemTime::now(), round_systime_to_secs(SystemTime::now() + Duration::from_secs(60 * 60 * 5)).unwrap(), vec![], vec![], vec![]);\n\n    let mut ca_pool = NebulaCAPool::new();\n    ca_pool.add_ca_certificate(\u0026ca_cert.serialize_to_pem().unwrap()).unwrap();\n\n    let fingerprint = cert.sha256sum().unwrap();\n    ca_pool.blocklist_fingerprint(\u0026fingerprint);\n\n    assert!(matches!(cert.verify(SystemTime::now(), \u0026ca_pool).unwrap(), CertificateValidity::Blocklisted));\n\n    ca_pool.reset_blocklist();\n\n    assert!(matches!(cert.verify(SystemTime::now() + Duration::from_secs(60 * 60 * 60), \u0026ca_pool).unwrap(), CertificateValidity::RootCertExpired));\n    assert!(matches!(cert.verify(SystemTime::now() + Duration::from_secs(60 * 60 * 6), \u0026ca_pool).unwrap(), CertificateValidity::CertExpired));\n\n    let (cert_with_bad_group, _, _) = test_cert(\u0026ca_cert, \u0026ca_key, round_systime_to_secs(SystemTime::now()).unwrap(), in_a_minute(), vec![], vec![], vec![\"group-not-present on parent\".to_string()]);\n    assert_eq!(cert_with_bad_group.verify(SystemTime::now(), \u0026ca_pool).unwrap(), CertificateValidity::GroupNotPresentOnSigner);\n\n    let (cert_with_good_group, _, _) = test_cert(\u0026ca_cert, \u0026ca_key, round_systime_to_secs(SystemTime::now()).unwrap(), in_a_minute(), vec![], vec![], vec![\"groupa\".to_string()]);\n    assert_eq!(cert_with_good_group.verify(SystemTime::now(), \u0026ca_pool).unwrap(), CertificateValidity::Ok);\n\n}\n\n#[test]\nfn cert_verify_ip() {\n    let ca_ip_1 = Ipv4Net::from_str(\"10.0.0.0/16\").unwrap();\n    let ca_ip_2 = Ipv4Net::from_str(\"192.168.0.0/24\").unwrap();\n\n    let (ca, ca_key, _ca_pub) = test_ca_cert(round_systime_to_secs(SystemTime::now()).unwrap(), round_systime_to_secs(SystemTime::now() + Duration::from_secs(60 * 60 * 10)).unwrap(), vec![ca_ip_1, ca_ip_2], vec![], vec![]);\n\n    let ca_pem = ca.serialize_to_pem().unwrap();\n\n    let mut ca_pool = NebulaCAPool::new();\n    ca_pool.add_ca_certificate(\u0026ca_pem).unwrap();\n\n    // ip is outside the network\n    let cip1 = netmask!(\"10.1.0.0\", \"255.255.255.0\");\n    let cip2 = netmask!(\"192.198.0.1\", \"255.255.0.0\");\n    let (cert, _, _) = test_cert(\u0026ca, \u0026ca_key, round_systime_to_secs(SystemTime::now()).unwrap(), round_systime_to_secs(SystemTime::now() + Duration::from_secs(60 * 60 * 5)).unwrap(), vec![cip1, cip2], vec![], vec![]);\n\n    assert_eq!(cert.verify(SystemTime::now(), \u0026ca_pool).unwrap(), CertificateValidity::IPNotPresentOnSigner);\n\n    // ip is outside the network - reversed order from above\n    let cip1 = netmask!(\"192.198.0.1\", \"255.255.255.0\");\n    let cip2 = netmask!(\"10.1.0.0\", \"255.255.255.0\");\n    let (cert, _, _) = test_cert(\u0026ca, \u0026ca_key, round_systime_to_secs(SystemTime::now()).unwrap(), round_systime_to_secs(SystemTime::now() + Duration::from_secs(60 * 60 * 5)).unwrap(), vec![cip1, cip2], vec![], vec![]);\n\n    assert_eq!(cert.verify(SystemTime::now(), \u0026ca_pool).unwrap(), CertificateValidity::IPNotPresentOnSigner);\n\n    // ip is within the network but mask is outside\n    let cip1 = netmask!(\"10.0.1.0\", \"255.254.0.0\");\n    let cip2 = netmask!(\"192.168.0.1\", \"255.255.255.0\");\n    let (cert, _, _) = test_cert(\u0026ca, \u0026ca_key, round_systime_to_secs(SystemTime::now()).unwrap(), round_systime_to_secs(SystemTime::now() + Duration::from_secs(60 * 60 * 5)).unwrap(), vec![cip1, cip2], vec![], vec![]);\n\n    assert_eq!(cert.verify(SystemTime::now(), \u0026ca_pool).unwrap(), CertificateValidity::IPNotPresentOnSigner);\n\n    // ip is within the network but mask is outside - reversed order from above\n    let cip1 = netmask!(\"192.168.0.1\", \"255.255.255.0\");\n    let cip2 = netmask!(\"10.0.1.0\", \"255.254.0.0\");\n    let (cert, _, _) = test_cert(\u0026ca, \u0026ca_key, round_systime_to_secs(SystemTime::now()).unwrap(), round_systime_to_secs(SystemTime::now() + Duration::from_secs(60 * 60 * 5)).unwrap(), vec![cip1, cip2], vec![], vec![]);\n\n    assert_eq!(cert.verify(SystemTime::now(), \u0026ca_pool).unwrap(), CertificateValidity::IPNotPresentOnSigner);\n\n    // ip and mask are within the network\n    let cip1 = netmask!(\"10.0.1.0\", \"255.255.0.0\");\n    let cip2 = netmask!(\"192.168.0.1\", \"255.255.255.128\");\n    let (cert, _, _) = test_cert(\u0026ca, \u0026ca_key, round_systime_to_secs(SystemTime::now()).unwrap(), round_systime_to_secs(SystemTime::now() + Duration::from_secs(60 * 60 * 5)).unwrap(), vec![cip1, cip2], vec![], vec![]);\n\n    assert_eq!(cert.verify(SystemTime::now(), \u0026ca_pool).unwrap(), CertificateValidity::Ok);\n\n    // Exact matches\n    let (cert, _, _) = test_cert(\u0026ca, \u0026ca_key, round_systime_to_secs(SystemTime::now()).unwrap(), round_systime_to_secs(SystemTime::now() + Duration::from_secs(60 * 60 * 5)).unwrap(), vec![ca_ip_1, ca_ip_2], vec![], vec![]);\n    assert_eq!(cert.verify(SystemTime::now(), \u0026ca_pool).unwrap(), CertificateValidity::Ok);\n\n    // Exact matches reversed\n    let (cert, _, _) = test_cert(\u0026ca, \u0026ca_key, round_systime_to_secs(SystemTime::now()).unwrap(), round_systime_to_secs(SystemTime::now() + Duration::from_secs(60 * 60 * 5)).unwrap(), vec![ca_ip_2, ca_ip_1], vec![], vec![]);\n    assert_eq!(cert.verify(SystemTime::now(), \u0026ca_pool).unwrap(), CertificateValidity::Ok);\n\n    // Exact matches reversed with just one\n    let (cert, _, _) = test_cert(\u0026ca, \u0026ca_key, round_systime_to_secs(SystemTime::now()).unwrap(), round_systime_to_secs(SystemTime::now() + Duration::from_secs(60 * 60 * 5)).unwrap(), vec![ca_ip_2], vec![], vec![]);\n    assert_eq!(cert.verify(SystemTime::now(), \u0026ca_pool).unwrap(), CertificateValidity::Ok);\n}\n\n#[test]\nfn cert_verify_subnet() {\n    let ca_ip_1 = Ipv4Net::from_str(\"10.0.0.0/16\").unwrap();\n    let ca_ip_2 = Ipv4Net::from_str(\"192.168.0.0/24\").unwrap();\n\n    let (ca, ca_key, _ca_pub) = test_ca_cert(round_systime_to_secs(SystemTime::now()).unwrap(), round_systime_to_secs(SystemTime::now() + Duration::from_secs(60 * 60 * 10)).unwrap(), vec![],vec![ca_ip_1, ca_ip_2], vec![]);\n\n    let ca_pem = ca.serialize_to_pem().unwrap();\n\n    let mut ca_pool = NebulaCAPool::new();\n    ca_pool.add_ca_certificate(\u0026ca_pem).unwrap();\n\n    // ip is outside the network\n    let cip1 = netmask!(\"10.1.0.0\", \"255.255.255.0\");\n    let cip2 = netmask!(\"192.198.0.1\", \"255.255.0.0\");\n    let (cert, _, _) = test_cert(\u0026ca, \u0026ca_key, round_systime_to_secs(SystemTime::now()).unwrap(), round_systime_to_secs(SystemTime::now() + Duration::from_secs(60 * 60 * 5)).unwrap(), vec![],vec![cip1, cip2], vec![]);\n\n    assert_eq!(cert.verify(SystemTime::now(), \u0026ca_pool).unwrap(), CertificateValidity::SubnetNotPresentOnSigner);\n\n    // ip is outside the network - reversed order from above\n    let cip1 = netmask!(\"192.198.0.1\", \"255.255.255.0\");\n    let cip2 = netmask!(\"10.1.0.0\", \"255.255.255.0\");\n    let (cert, _, _) = test_cert(\u0026ca, \u0026ca_key, round_systime_to_secs(SystemTime::now()).unwrap(), round_systime_to_secs(SystemTime::now() + Duration::from_secs(60 * 60 * 5)).unwrap(), vec![],vec![cip1, cip2], vec![]);\n\n    assert_eq!(cert.verify(SystemTime::now(), \u0026ca_pool).unwrap(), CertificateValidity::SubnetNotPresentOnSigner);\n\n    // ip is within the network but mask is outside\n    let cip1 = netmask!(\"10.0.1.0\", \"255.254.0.0\");\n    let cip2 = netmask!(\"192.168.0.1\", \"255.255.255.0\");\n    let (cert, _, _) = test_cert(\u0026ca, \u0026ca_key, round_systime_to_secs(SystemTime::now()).unwrap(), round_systime_to_secs(SystemTime::now() + Duration::from_secs(60 * 60 * 5)).unwrap(), vec![],vec![cip1, cip2], vec![]);\n\n    assert_eq!(cert.verify(SystemTime::now(), \u0026ca_pool).unwrap(), CertificateValidity::SubnetNotPresentOnSigner);\n\n    // ip is within the network but mask is outside - reversed order from above\n    let cip1 = netmask!(\"192.168.0.1\", \"255.255.255.0\");\n    let cip2 = netmask!(\"10.0.1.0\", \"255.254.0.0\");\n    let (cert, _, _) = test_cert(\u0026ca, \u0026ca_key, round_systime_to_secs(SystemTime::now()).unwrap(), round_systime_to_secs(SystemTime::now() + Duration::from_secs(60 * 60 * 5)).unwrap(), vec![cip1, cip2], vec![], vec![]);\n\n    assert_eq!(cert.verify(SystemTime::now(), \u0026ca_pool).unwrap(), CertificateValidity::SubnetNotPresentOnSigner);\n\n    // ip and mask are within the network\n    let cip1 = netmask!(\"10.0.1.0\", \"255.255.0.0\");\n    let cip2 = netmask!(\"192.168.0.1\", \"255.255.255.128\");\n    let (cert, _, _) = test_cert(\u0026ca, \u0026ca_key, round_systime_to_secs(SystemTime::now()).unwrap(), round_systime_to_secs(SystemTime::now() + Duration::from_secs(60 * 60 * 5)).unwrap(), vec![], vec![cip1, cip2], vec![]);\n\n    assert_eq!(cert.verify(SystemTime::now(), \u0026ca_pool).unwrap(), CertificateValidity::Ok);\n\n    // Exact matches\n    let (cert, _, _) = test_cert(\u0026ca, \u0026ca_key, round_systime_to_secs(SystemTime::now()).unwrap(), round_systime_to_secs(SystemTime::now() + Duration::from_secs(60 * 60 * 5)).unwrap(), vec![],vec![ca_ip_1, ca_ip_2], vec![]);\n    assert_eq!(cert.verify(SystemTime::now(), \u0026ca_pool).unwrap(), CertificateValidity::Ok);\n\n    // Exact matches reversed\n    let (cert, _, _) = test_cert(\u0026ca, \u0026ca_key, round_systime_to_secs(SystemTime::now()).unwrap(), round_systime_to_secs(SystemTime::now() + Duration::from_secs(60 * 60 * 5)).unwrap(), vec![], vec![ca_ip_2, ca_ip_1], vec![]);\n    assert_eq!(cert.verify(SystemTime::now(), \u0026ca_pool).unwrap(), CertificateValidity::Ok);\n\n    // Exact matches reversed with just one\n    let (cert, _, _) = test_cert(\u0026ca, \u0026ca_key, round_systime_to_secs(SystemTime::now()).unwrap(), round_systime_to_secs(SystemTime::now() + Duration::from_secs(60 * 60 * 5)).unwrap(), vec![], vec![ca_ip_2], vec![]);\n    assert_eq!(cert.verify(SystemTime::now(), \u0026ca_pool).unwrap(), CertificateValidity::Ok);\n}\n\n#[test]\nfn cert_private_key() {\n    let (ca, ca_key, _) = test_ca_cert(SystemTime::now(), SystemTime::now(), vec![], vec![], vec![]);\n    ca.verify_private_key(\u0026ca_key.to_keypair_bytes()).unwrap();\n\n    let (_, ca_key2, _) = test_ca_cert(SystemTime::now(), SystemTime::now(), vec![], vec![], vec![]);\n    ca.verify_private_key(\u0026ca_key2.to_keypair_bytes()).unwrap_err();\n\n    let (cert, priv_key, _) = test_cert(\u0026ca, \u0026ca_key, SystemTime::now(), SystemTime::now(), vec![], vec![], vec![]);\n    cert.verify_private_key(\u0026priv_key.to_bytes()).unwrap();\n\n    let (cert2, _, _) = test_cert(\u0026ca, \u0026ca_key, SystemTime::now(), SystemTime::now(), vec![], vec![], vec![]);\n    cert2.verify_private_key(\u0026priv_key.to_bytes()).unwrap_err();\n}\n\n#[test]\nfn capool_from_pem() {\n    let no_newlines = b\"# Current provisional, Remove once everything moves over to the real root.\n-----BEGIN NEBULA CERTIFICATE-----\nCkAKDm5lYnVsYSByb290IGNhKJfap9AFMJfg1+YGOiCUQGByMuNRhIlQBOyzXWbL\nvcKBwDhov900phEfJ5DN3kABEkDCq5R8qBiu8sl54yVfgRcQXEDt3cHr8UTSLszv\nbzBEr00kERQxxTzTsH8cpYEgRoipvmExvg8WP8NdAJEYJosB\n-----END NEBULA CERTIFICATE-----\n# root-ca01\n-----BEGIN NEBULA CERTIFICATE-----\nCkMKEW5lYnVsYSByb290IGNhIDAxKJL2u9EFMJL86+cGOiDPXMH4oU6HZTk/CqTG\nBVG+oJpAoqokUBbI4U0N8CSfpUABEkB/Pm5A2xyH/nc8mg/wvGUWG3pZ7nHzaDMf\n8/phAUt+FLzqTECzQKisYswKvE3pl9mbEYKbOdIHrxdIp95mo4sF\n-----END NEBULA CERTIFICATE-----\";\n    let with_newlines = b\"# Current provisional, Remove once everything moves over to the real root.\n-----BEGIN NEBULA CERTIFICATE-----\nCkAKDm5lYnVsYSByb290IGNhKJfap9AFMJfg1+YGOiCUQGByMuNRhIlQBOyzXWbL\nvcKBwDhov900phEfJ5DN3kABEkDCq5R8qBiu8sl54yVfgRcQXEDt3cHr8UTSLszv\nbzBEr00kERQxxTzTsH8cpYEgRoipvmExvg8WP8NdAJEYJosB\n-----END NEBULA CERTIFICATE-----\n# root-ca01\n-----BEGIN NEBULA CERTIFICATE-----\nCkMKEW5lYnVsYSByb290IGNhIDAxKJL2u9EFMJL86+cGOiDPXMH4oU6HZTk/CqTG\nBVG+oJpAoqokUBbI4U0N8CSfpUABEkB/Pm5A2xyH/nc8mg/wvGUWG3pZ7nHzaDMf\n8/phAUt+FLzqTECzQKisYswKvE3pl9mbEYKbOdIHrxdIp95mo4sF\n-----END NEBULA CERTIFICATE-----\n\n\";\n    let expired = b\"# expired certificate\n-----BEGIN NEBULA CERTIFICATE-----\nCjkKB2V4cGlyZWQouPmWjQYwufmWjQY6ILCRaoCkJlqHgv5jfDN4lzLHBvDzaQm4\nvZxfu144hmgjQAESQG4qlnZi8DncvD/LDZnLgJHOaX1DWCHHEh59epVsC+BNgTie\nWH1M9n4O7cFtGlM6sJJOS+rCVVEJ3ABS7+MPdQs=\n-----END NEBULA CERTIFICATE-----\";\n\n    let pool_a = NebulaCAPool::new_from_pem(no_newlines).unwrap();\n    assert_eq!(pool_a.cas[\"c9bfaf7ce8e84b2eeda2e27b469f4b9617bde192efd214b68891ecda6ed49522\"].details.name, \"nebula root ca\".to_string());\n    assert_eq!(pool_a.cas[\"5c9c3f23e7ee7fe97637cbd3a0a5b854154d1d9aaaf7b566a51f4a88f76b64cd\"].details.name, \"nebula root ca 01\".to_string());\n    assert!(!pool_a.expired);\n\n    let pool_b = NebulaCAPool::new_from_pem(with_newlines).unwrap();\n    assert_eq!(pool_b.cas[\"c9bfaf7ce8e84b2eeda2e27b469f4b9617bde192efd214b68891ecda6ed49522\"].details.name, \"nebula root ca\".to_string());\n    assert_eq!(pool_b.cas[\"5c9c3f23e7ee7fe97637cbd3a0a5b854154d1d9aaaf7b566a51f4a88f76b64cd\"].details.name, \"nebula root ca 01\".to_string());\n    assert!(!pool_b.expired);\n\n    let pool_c = NebulaCAPool::new_from_pem(expired).unwrap();\n    assert!(pool_c.expired);\n    assert_eq!(pool_c.cas[\"152070be6bb19bc9e3bde4c2f0e7d8f4ff5448b4c9856b8eccb314fade0229b0\"].details.name, \"expired\");\n\n    let mut pool_d = NebulaCAPool::new_from_pem(with_newlines).unwrap();\n    pool_d.add_ca_certificate(expired).unwrap();\n    assert_eq!(pool_d.cas[\"c9bfaf7ce8e84b2eeda2e27b469f4b9617bde192efd214b68891ecda6ed49522\"].details.name, \"nebula root ca\".to_string());\n    assert_eq!(pool_d.cas[\"5c9c3f23e7ee7fe97637cbd3a0a5b854154d1d9aaaf7b566a51f4a88f76b64cd\"].details.name, \"nebula root ca 01\".to_string());\n    assert_eq!(pool_d.cas[\"152070be6bb19bc9e3bde4c2f0e7d8f4ff5448b4c9856b8eccb314fade0229b0\"].details.name, \"expired\");\n    assert!(pool_d.expired);\n    assert_eq!(pool_d.get_fingerprints().len(), 3);\n}\n\n#[macro_export]\nmacro_rules! netmask {\n    ($ip:expr,$mask:expr) =\u003e {\n        Ipv4Net::with_netmask(Ipv4Addr::from_str($ip).unwrap(), Ipv4Addr::from_str($mask).unwrap()).unwrap()\n    };\n}\n\nfn round_systime_to_secs(time: SystemTime) -\u003e Result\u003cSystemTime, SystemTimeError\u003e {\n    let secs = time.duration_since(UNIX_EPOCH)?.as_secs();\n    Ok(SystemTime::UNIX_EPOCH.add(Duration::from_secs(secs)))\n}\n\nfn test_ca_cert(before: SystemTime, after: SystemTime, ips: Vec\u003cIpv4Net\u003e, subnets: Vec\u003cIpv4Net\u003e, groups: Vec\u003cString\u003e) -\u003e (NebulaCertificate, SigningKey, VerifyingKey) {\n    let mut csprng = OsRng;\n    let key = SigningKey::generate(\u0026mut csprng);\n    let pub_key = key.verifying_key();\n\n    let mut cert = NebulaCertificate {\n        details: NebulaCertificateDetails {\n            name: \"TEST_CA\".to_string(),\n            ips,\n            subnets,\n            groups,\n            not_before: before,\n            not_after: after,\n            public_key: pub_key.to_bytes(),\n            is_ca: true,\n            issuer: \"\".to_string(),\n        },\n        signature: vec![],\n    };\n    cert.sign(\u0026key).unwrap();\n    (cert, key, pub_key)\n}\n\nfn test_cert(ca: \u0026NebulaCertificate, key: \u0026SigningKey, before: SystemTime, after: SystemTime, ips: Vec\u003cIpv4Net\u003e, subnets: Vec\u003cIpv4Net\u003e, groups: Vec\u003cString\u003e) -\u003e (NebulaCertificate, SigningKey, VerifyingKey) {\n    let issuer = ca.sha256sum().unwrap();\n\n    let real_groups = if groups.is_empty() {\n        vec![\"test-group1\".to_string(), \"test-group2\".to_string(), \"test-group3\".to_string()]\n    } else {\n        groups\n    };\n\n    let real_ips = if ips.is_empty() {\n        vec![\n            netmask!(\"10.1.1.1\", \"255.255.255.0\"),\n            netmask!(\"10.1.1.2\", \"255.255.0.0\"),\n            netmask!(\"10.1.1.3\", \"255.0.0.0\")\n        ]\n    } else {\n        ips\n    };\n\n    let real_subnets = if subnets.is_empty() {\n        vec![\n            netmask!(\"9.1.1.1\", \"255.255.255.128\"),\n            netmask!(\"9.1.1.2\", \"255.255.255.0\"),\n            netmask!(\"9.1.1.3\", \"255.255.0.0\")\n        ]\n    } else {\n        subnets\n    };\n\n    let mut csprng = OsRng;\n    let cert_key = SigningKey::generate(\u0026mut csprng);\n    let pub_key = cert_key.verifying_key();\n\n    let mut cert = NebulaCertificate {\n        details: NebulaCertificateDetails {\n            name: \"TEST_CA\".to_string(),\n            ips: real_ips,\n            subnets: real_subnets,\n            groups: real_groups,\n            not_before: before,\n            not_after: after,\n            public_key: pub_key.to_bytes(),\n            is_ca: false,\n            issuer,\n        },\n        signature: vec![],\n    };\n    cert.sign(key).unwrap();\n    (cert, cert_key, pub_key)\n}\n\n#[allow(dead_code)]\nfn in_a_minute() -\u003e SystemTime {\n    round_systime_to_secs(SystemTime::now().add(Duration::from_secs(60))).unwrap()\n}\n#[allow(dead_code)]\nfn a_minute_ago() -\u003e SystemTime {\n    round_systime_to_secs(SystemTime::now().sub(Duration::from_secs(60))).unwrap()\n}","traces":[],"covered":0,"coverable":0}]};
     </script>
     <script crossorigin>/** @license React v16.13.1
  * react.production.min.js
