Skip to content

implement response signing for manager and patches routes #222

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
uvindusl wants to merge 3 commits into
base: dev
Choose a base branch
from
Open

implement response signing for manager and patches routes #222

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
5cd61a9
added node-forge library to handle x509 certificates
uvindusl May 7, 2026
caf6d14
feat: added funtion to digitally signs API responses to ensure authen…
uvindusl May 7, 2026
2350cf6
feat: handled cryptographic signing and ensuring schema synchronizati…
uvindusl May 7, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions bun.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 2 additions & 0 deletions package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,7 @@
"@hono/zod-openapi": "^1.2.2",
"drizzle-orm": "^0.45.1",
"hono": "^4.12.8",
"node-forge": "^1.4.0",
"zod": "^4.3.6"
},
"devDependencies": {
Expand All @@ -32,6 +33,7 @@
"@semantic-release/git": "^10.0.1",
"@semantic-release/npm": "^13.1.5",
"@types/node": "^25.5.0",
"@types/node-forge": "^1.3.14",
"drizzle-kit": "^0.31.10",
"prettier": "3.8.1",
"semantic-release": "^25.0.3",
Expand Down
64 changes: 39 additions & 25 deletions src/routes/manager.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,9 +4,13 @@ import { ErrorResponseSchema } from '../schemas/common';
import {
ReleaseResponseSchema,
VersionResponseSchema,
HistoryResponseSchema
HistoryResponseSchema,
SignedReleaseResponseSchema,
SignedVersionResponseSchema,
SignedHistoryResponseSchema
} from '../schemas/releases';
import * as managerService from '../services/manager';
import { signResponse } from "../services/signature";

const app = new OpenAPIHono<{ Bindings: Env }>();

Expand All @@ -20,7 +24,7 @@ app.openapi(
responses: {
200: {
content: {
'application/json': { schema: ReleaseResponseSchema }
'application/json': { schema: SignedReleaseResponseSchema }
},
description: 'The latest manager release.'
},
Expand All @@ -33,7 +37,8 @@ app.openapi(
}
}),
async (c) => {
return c.json(await managerService.getRelease(c.env, false), 200);
const data = await managerService.getRelease(c.env, false);
return c.json( signResponse(data, c.env.MANAGER_PRIVATE_KEY, c.env.MANAGER_CERT), 200);
}
);

Expand All @@ -47,7 +52,7 @@ app.openapi(
responses: {
200: {
content: {
'application/json': { schema: ReleaseResponseSchema }
'application/json': { schema: SignedReleaseResponseSchema }
},
description: 'The latest manager prerelease.'
},
Expand All @@ -60,7 +65,8 @@ app.openapi(
}
}),
async (c) => {
return c.json(await managerService.getRelease(c.env, true), 200);
const data = await managerService.getRelease(c.env, true);
return c.json( signResponse(data, c.env.MANAGER_PRIVATE_KEY, c.env.MANAGER_CERT), 200);
}
);

Expand All @@ -74,7 +80,7 @@ app.openapi(
responses: {
200: {
content: {
'application/json': { schema: VersionResponseSchema }
'application/json': { schema: SignedVersionResponseSchema }
},
description: 'The current manager release version.'
},
Expand All @@ -87,7 +93,8 @@ app.openapi(
}
}),
async (c) => {
return c.json(await managerService.getVersion(c.env, false), 200);
const data = await managerService.getVersion(c.env, false);
return c.json( signResponse(data, c.env.MANAGER_PRIVATE_KEY, c.env.MANAGER_CERT), 200);
}
);

Expand All @@ -101,7 +108,7 @@ app.openapi(
responses: {
200: {
content: {
'application/json': { schema: VersionResponseSchema }
'application/json': { schema: SignedVersionResponseSchema }
},
description: 'The current manager prerelease version.'
},
Expand All @@ -114,7 +121,8 @@ app.openapi(
}
}),
async (c) => {
return c.json(await managerService.getVersion(c.env, true), 200);
const data = await managerService.getVersion(c.env, true);
return c.json( signResponse(data, c.env.MANAGER_PRIVATE_KEY, c.env.MANAGER_CERT), 200);
}
);

Expand All @@ -128,7 +136,7 @@ app.openapi(
responses: {
200: {
content: {
'application/json': { schema: HistoryResponseSchema }
'application/json': { schema: SignedHistoryResponseSchema }
},
description: 'The manager release history.'
},
Expand All @@ -141,7 +149,8 @@ app.openapi(
}
}),
async (c) => {
return c.json(await managerService.getHistory(c.env, false), 200);
const data = await managerService.getHistory(c.env, false);
return c.json( signResponse(data, c.env.MANAGER_PRIVATE_KEY, c.env.MANAGER_CERT), 200);
}
);

Expand All @@ -155,7 +164,7 @@ app.openapi(
responses: {
200: {
content: {
'application/json': { schema: HistoryResponseSchema }
'application/json': { schema: SignedHistoryResponseSchema }
},
description: 'The manager prerelease history.'
},
Expand All @@ -168,7 +177,8 @@ app.openapi(
}
}),
async (c) => {
return c.json(await managerService.getHistory(c.env, true), 200);
const data = await managerService.getHistory(c.env, true);
return c.json( signResponse(data, c.env.MANAGER_PRIVATE_KEY, c.env.MANAGER_CERT), 200);
}
);

Expand All @@ -182,7 +192,7 @@ app.openapi(
responses: {
200: {
content: {
'application/json': { schema: ReleaseResponseSchema }
'application/json': { schema: SignedReleaseResponseSchema }
},
description: 'The latest manager downloaders release.'
},
Expand All @@ -195,10 +205,11 @@ app.openapi(
}
}),
async (c) => {
const data = await managerService.getDownloadersRelease(c.env, false);
return c.json(
await managerService.getDownloadersRelease(c.env, false),
signResponse(data, c.env.DOWNLOADER_PRIVATE_KEY, c.env.DOWNLOADER_CERT),
200
);
);
}
);

Expand All @@ -212,7 +223,7 @@ app.openapi(
responses: {
200: {
content: {
'application/json': { schema: ReleaseResponseSchema }
'application/json': { schema: SignedReleaseResponseSchema }
},
description: 'The latest manager downloaders prerelease.'
},
Expand All @@ -225,10 +236,11 @@ app.openapi(
}
}),
async (c) => {
const data = await managerService.getDownloadersRelease(c.env, true);
return c.json(
await managerService.getDownloadersRelease(c.env, true),
signResponse(data, c.env.DOWNLOADER_PRIVATE_KEY, c.env.DOWNLOADER_CERT),
200
);
);
}
);

Expand All @@ -243,7 +255,7 @@ app.openapi(
responses: {
200: {
content: {
'application/json': { schema: VersionResponseSchema }
'application/json': { schema: SignedVersionResponseSchema }
},
description: 'The current manager downloaders release version.'
},
Expand All @@ -256,10 +268,11 @@ app.openapi(
}
}),
async (c) => {
const data = await managerService.getDownloadersRelease(c.env, false);
return c.json(
await managerService.getDownloadersVersion(c.env, false),
signResponse(data, c.env.DOWNLOADER_PRIVATE_KEY, c.env.DOWNLOADER_CERT),
200
);
);
}
);

Expand All @@ -273,7 +286,7 @@ app.openapi(
responses: {
200: {
content: {
'application/json': { schema: VersionResponseSchema }
'application/json': { schema: SignedVersionResponseSchema }
},
description:
'The current manager downloaders prerelease version.'
Expand All @@ -287,10 +300,11 @@ app.openapi(
}
}),
async (c) => {
const data = await managerService.getDownloadersRelease(c.env, true);
return c.json(
await managerService.getDownloadersVersion(c.env, true),
signResponse(data, c.env.DOWNLOADER_PRIVATE_KEY, c.env.DOWNLOADER_CERT),
200
);
);
}
);

Expand Down
36 changes: 23 additions & 13 deletions src/routes/patches.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,9 +5,13 @@ import {
ReleaseResponseSchema,
VersionResponseSchema,
HistoryResponseSchema,
PublicKeyResponseSchema
PublicKeyResponseSchema,
SignedReleaseResponseSchema,
SignedVersionResponseSchema,
SignedHistoryResponseSchema
} from '../schemas/releases';
import * as patchesService from '../services/patches';
import { signResponse } from "../services/signature";

const app = new OpenAPIHono<{ Bindings: Env }>();

Expand All @@ -21,7 +25,7 @@ app.openapi(
responses: {
200: {
content: {
'application/json': { schema: ReleaseResponseSchema }
'application/json': { schema: SignedReleaseResponseSchema }
},
description: 'The current patches release.'
},
Expand All @@ -34,7 +38,8 @@ app.openapi(
}
}),
async (c) => {
return c.json(await patchesService.getRelease(c.env, false), 200);
const data = await patchesService.getRelease(c.env, false);
return c.json(signResponse(data, c.env.PATCHES_PRIVATE_KEY, c.env.PATCHES_CERT), 200);
}
);

Expand All @@ -48,7 +53,7 @@ app.openapi(
responses: {
200: {
content: {
'application/json': { schema: ReleaseResponseSchema }
'application/json': { schema: SignedReleaseResponseSchema }
},
description: 'The current patches prerelease.'
},
Expand All @@ -61,7 +66,8 @@ app.openapi(
}
}),
async (c) => {
return c.json(await patchesService.getRelease(c.env, true), 200);
const data = await patchesService.getRelease(c.env, true);
return c.json(signResponse(data, c.env.PATCHES_PRIVATE_KEY, c.env.PATCHES_CERT), 200);
}
);

Expand All @@ -77,7 +83,7 @@ app.openapi(
responses: {
200: {
content: {
'application/json': { schema: VersionResponseSchema }
'application/json': { schema: SignedVersionResponseSchema }
},
description: 'The current patches release version.'
},
Expand All @@ -90,7 +96,8 @@ app.openapi(
}
}),
async (c) => {
return c.json(await patchesService.getVersion(c.env, false), 200);
const data = await patchesService.getVersion(c.env, false);
return c.json(signResponse(data, c.env.PATCHES_PRIVATE_KEY, c.env.PATCHES_CERT), 200);
}
);

Expand All @@ -104,7 +111,7 @@ app.openapi(
responses: {
200: {
content: {
'application/json': { schema: VersionResponseSchema }
'application/json': { schema: SignedVersionResponseSchema }
},
description: 'The current patches prerelease version.'
},
Expand All @@ -117,7 +124,8 @@ app.openapi(
}
}),
async (c) => {
return c.json(await patchesService.getVersion(c.env, true), 200);
const data = await patchesService.getVersion(c.env, true);
return c.json(signResponse(data, c.env.PATCHES_PRIVATE_KEY, c.env.PATCHES_CERT), 200);
}
);

Expand All @@ -131,7 +139,7 @@ app.openapi(
responses: {
200: {
content: {
'application/json': { schema: HistoryResponseSchema }
'application/json': { schema: SignedHistoryResponseSchema }
},
description: 'The patches release history.'
},
Expand All @@ -144,7 +152,8 @@ app.openapi(
}
}),
async (c) => {
return c.json(await patchesService.getHistory(c.env, false), 200);
const data = await patchesService.getHistory(c.env, false);
return c.json(signResponse(data, c.env.PATCHES_PRIVATE_KEY, c.env.PATCHES_CERT), 200);
}
);

Expand All @@ -158,7 +167,7 @@ app.openapi(
responses: {
200: {
content: {
'application/json': { schema: HistoryResponseSchema }
'application/json': { schema: SignedHistoryResponseSchema }
},
description: 'The patches prerelease history.'
},
Expand All @@ -171,7 +180,8 @@ app.openapi(
}
}),
async (c) => {
return c.json(await patchesService.getHistory(c.env, true), 200);
const data = await patchesService.getHistory(c.env, true);
return c.json(signResponse(data, c.env.PATCHES_PRIVATE_KEY, c.env.PATCHES_CERT), 200);
}
);

Expand Down
Loading