Import SSH revocation metadata

crates/geth-node/src/lib.rs

@@ -26,8 +26,8 @@ use geth_secrets::{BearerAccess, ResourceMasterSecret};
 use geth_ssh_identity::{
     SshCertApproval, SshCertKind, SshCertRequest, SshCertRequestStatus, SshCertificateRecord,
     SshRevocationEntry, SshRevocationExportFormat, SshRevocationKind, build_ssh_cert_sign_command,
-    cert_request_id, certificate_id, openssh_krl_spec, revocation_id, ssh_public_key_fingerprint,
-    write_openssh_krl,
+    cert_request_id, certificate_id, openssh_krl_spec, parse_openssh_krl_spec, revocation_id,
+    ssh_public_key_fingerprint, write_openssh_krl,
 };
 use geth_store::{
     Store, StoredAuthOp, StoredDbResource, StoredDocumentResource, StoredFileConflict,
@@ -948,6 +948,53 @@ pub fn handle_request(
                 note,
             })
         }
+        ControlRequest::SshRevocationImport { path, format } => {
+            let body = std::fs::read_to_string(&path)?;
+            let created_at = UnixMillis(geth_store::now_ms());
+            let revocations = match format.as_str() {
+                "jsonl" => body
+                    .lines()
+                    .filter(|line| !line.trim().is_empty())
+                    .map(|line| serde_json::from_str(line).map_err(NodeError::from))
+                    .collect::<Result<Vec<SshRevocationEntry>, NodeError>>()?,
+                "openssh-krl-spec" | "krl-spec" => parse_openssh_krl_spec(&body)?
+                    .into_iter()
+                    .enumerate()
+                    .map(|(index, (kind, target))| {
+                        let created_at = UnixMillis(created_at.0 + index as i64);
+                        SshRevocationEntry {
+                            id: revocation_id(&kind, &target, created_at),
+                            kind,
+                            target,
+                            reason: Some(format!("imported from {}", path.display())),
+                            created_at,
+                            published: true,
+                        }
+                    })
+                    .collect(),
+                "openssh-krl" | "krl" => {
+                    return Err(NodeError::SshIdentity(
+                        geth_ssh_identity::SshIdentityError::BinaryKrlImportUnsupported,
+                    ));
+                }
+                _ => {
+                    return Err(NodeError::SshIdentity(
+                        geth_ssh_identity::SshIdentityError::InvalidRevocationExportFormat(
+                            format.clone(),
+                        ),
+                    ));
+                }
+            };
+            for revocation in &revocations {
+                store.insert_ssh_revocation(&stored_from_ssh_revocation(revocation))?;
+            }
+            Ok(ControlResponse::SshRevocationImported {
+                count: revocations.len(),
+                revocations,
+                format,
+                note: "imported revocation metadata; binary OpenSSH KRL files cannot be enumerated, import JSONL or the KRL spec source instead".to_owned(),
+            })
+        }
         ControlRequest::DbAdd { name, path } => {
             geth_db::validate_db_name(&name).map_err(|_| NodeError::InvalidDbName(name.clone()))?;
             if !path.is_file() {