probo/pkg/coredata/cached_certificate.go

// Copyright (c) 2025-2026 Probo Inc <hello@probo.com>.
//
// Permission is hereby granted, free of charge, to any person obtaining a copy
// of this software and associated documentation files (the "Software"), to deal
// in the Software without restriction, including without limitation the rights
// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
// copies of the Software, and to permit persons to whom the Software is
// furnished to do so, subject to the following conditions:
//
// The above copyright notice and this permission notice shall be included in
// all copies or substantial portions of the Software.
//
// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
// SOFTWARE.

package coredata

import (
	"context"
	"fmt"
	"time"

	"github.com/jackc/pgx/v5"
	"go.gearno.de/kit/pg"
	"go.probo.inc/probo/pkg/crypto/cipher"
	"go.probo.inc/probo/pkg/gid"
)

type (
	CachedCertificate struct {
		Domain           string    `db:"domain"`
		CertificatePEM   string    `db:"certificate_pem"`
		PrivateKeyPEM    string    `db:"private_key_pem"` // Decrypted for fast TLS handshake
		CertificateChain *string   `db:"certificate_chain"`
		ExpiresAt        time.Time `db:"expires_at"`
		CachedAt         time.Time `db:"cached_at"`
		CustomDomainID   gid.GID   `db:"custom_domain_id"`
	}

	CachedCertificates []*CachedCertificate
)

func (cc *CachedCertificate) LoadByDomain(ctx context.Context, conn pg.Querier, domain string) error {
	q := `
SELECT
	domain,
	certificate_pem,
	private_key_pem,
	certificate_chain,
	expires_at,
	cached_at,
	custom_domain_id
FROM
	cached_certificates
WHERE
	domain = @domain
	AND expires_at > NOW()
LIMIT 1
`

	args := pgx.NamedArgs{"domain": domain}

	rows, err := conn.Query(ctx, q, args)
	if err != nil {
		return fmt.Errorf("cannot query certificate cache: %w", err)
	}

	cache, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[CachedCertificate])
	if err != nil {
		return fmt.Errorf("cannot collect certificate cache: %w", err)
	}

	*cc = cache

	return nil
}

func (cc *CachedCertificate) Upsert(ctx context.Context, conn pg.Querier) error {
	cc.CachedAt = time.Now()

	q := `
INSERT INTO cached_certificates (
	domain,
	certificate_pem,
	private_key_pem,
	certificate_chain,
	expires_at,
	cached_at,
	custom_domain_id
) VALUES (
	@domain,
	@certificate_pem,
	@private_key_pem,
	@certificate_chain,
	@expires_at,
	@cached_at,
	@custom_domain_id
)
ON CONFLICT (domain) DO UPDATE SET
	certificate_pem = EXCLUDED.certificate_pem,
	private_key_pem = EXCLUDED.private_key_pem,
	certificate_chain = EXCLUDED.certificate_chain,
	expires_at = EXCLUDED.expires_at,
	cached_at = NOW(),
	custom_domain_id = EXCLUDED.custom_domain_id
`

	args := pgx.NamedArgs{
		"domain":            cc.Domain,
		"certificate_pem":   cc.CertificatePEM,
		"private_key_pem":   cc.PrivateKeyPEM,
		"certificate_chain": cc.CertificateChain,
		"expires_at":        cc.ExpiresAt,
		"cached_at":         cc.CachedAt,
		"custom_domain_id":  cc.CustomDomainID,
	}

	_, err := conn.Exec(ctx, q, args)
	if err != nil {
		return fmt.Errorf("cannot upsert certificate cache: %w", err)
	}

	return nil
}

func (cc *CachedCertificate) Delete(ctx context.Context, conn pg.Tx, domain string) error {
	q := `DELETE FROM cached_certificates WHERE domain = @domain`
	args := pgx.NamedArgs{"domain": domain}

	_, err := conn.Exec(ctx, q, args)
	if err != nil {
		return fmt.Errorf("cannot delete certificate cache: %w", err)
	}

	return nil
}

func (cc *CachedCertificates) CountAll(ctx context.Context, conn pg.Querier) (int, error) {
	q := `SELECT COUNT(*) FROM cached_certificates`

	var count int

	err := conn.QueryRow(ctx, q, pgx.NamedArgs{}).Scan(&count)
	if err != nil {
		return 0, fmt.Errorf("cannot count certificate cache: %w", err)
	}

	return count, nil
}

func (cc *CachedCertificates) CleanExpired(ctx context.Context, conn pg.Querier) error {
	q := `
DELETE
FROM
	cached_certificates
WHERE
	expires_at < NOW() - INTERVAL '30 days'
`

	_, err := conn.Exec(ctx, q, pgx.NamedArgs{})
	if err != nil {
		return fmt.Errorf("cannot clean expired cache: %w", err)
	}

	return nil
}

func (cc *CachedCertificate) RefreshFromDomain(ctx context.Context, conn pg.Querier, domain *CustomDomain, encryptionKey cipher.EncryptionKey) error {
	if domain.SSLCertificate == nil {
		return fmt.Errorf("domain has no parsed certificate")
	}

	if len(domain.SSLCertificatePEM) == 0 {
		return fmt.Errorf("domain has no certificate PEM")
	}

	privateKeyPEM, err := domain.DecryptPrivateKey(encryptionKey)
	if err != nil {
		return fmt.Errorf("cannot decrypt private key: %w", err)
	}

	if len(privateKeyPEM) == 0 {
		return fmt.Errorf("domain has no private key PEM")
	}

	if domain.SSLExpiresAt == nil {
		return fmt.Errorf("domain certificate has no expiry date")
	}

	cache := &CachedCertificate{
		Domain:           domain.Domain,
		CertificatePEM:   string(domain.SSLCertificatePEM),
		PrivateKeyPEM:    string(privateKeyPEM),
		CertificateChain: domain.SSLCertificateChain,
		ExpiresAt:        *domain.SSLExpiresAt,
		CachedAt:         time.Now(),
		CustomDomainID:   domain.ID,
	}

	return cache.Upsert(ctx, conn)
}