Hello <%= name %>,
+please click here to verify your key.
\ No newline at end of file diff --git a/src/email/templates/verifyKey/subject.ejs b/src/email/templates/verifyKey/subject.ejs new file mode 100644 index 0000000..3216cd9 --- /dev/null +++ b/src/email/templates/verifyKey/subject.ejs @@ -0,0 +1 @@ +Verify Your Key \ No newline at end of file diff --git a/src/email/templates/verifyRemove/html.ejs b/src/email/templates/verifyRemove/html.ejs new file mode 100644 index 0000000..5c1b86c --- /dev/null +++ b/src/email/templates/verifyRemove/html.ejs @@ -0,0 +1,2 @@ +Hello <%= name %>,
+please click here to verify the removal of your key.
\ No newline at end of file diff --git a/src/email/templates/verifyRemove/subject.ejs b/src/email/templates/verifyRemove/subject.ejs new file mode 100644 index 0000000..83f6089 --- /dev/null +++ b/src/email/templates/verifyRemove/subject.ejs @@ -0,0 +1 @@ +Verify Key Removal \ No newline at end of file diff --git a/src/service/pgp.js b/src/service/pgp.js index 3e525c9..25f1436 100644 --- a/src/service/pgp.js +++ b/src/service/pgp.js @@ -34,10 +34,10 @@ class PGP { * @param {String} publicKeyArmored ascii armored pgp key block * @return {Object} public key document to persist */ - parseKey(publicKeyArmored) { + async parseKey(publicKeyArmored) { publicKeyArmored = this.trimKey(publicKeyArmored); - const r = openpgp.key.readArmored(publicKeyArmored); + const r = await openpgp.key.readArmored(publicKeyArmored); if (r.err) { const error = r.err[0]; log.error('pgp', 'Failed to parse PGP key:\n%s', publicKeyArmored, error); @@ -49,23 +49,26 @@ class PGP { // verify primary key const key = r.keys[0]; const primaryKey = key.primaryKey; - if (key.verifyPrimaryKey() !== openpgp.enums.keyStatus.valid) { + if (await key.verifyPrimaryKey() !== openpgp.enums.keyStatus.valid) { util.throw(400, 'Invalid PGP key: primary key verification failed'); } // accept version 4 keys only const keyId = primaryKey.getKeyId().toHex(); - const fingerprint = primaryKey.fingerprint; + const fingerprint = primaryKey.getFingerprint(); if (!util.isKeyId(keyId) || !util.isFingerPrint(fingerprint)) { util.throw(400, 'Invalid PGP key: only v4 keys are accepted'); } // check for at least one valid user id - const userIds = this.parseUserIds(key.users, primaryKey); + const userIds = await this.parseUserIds(key.users, primaryKey); if (!userIds.length) { util.throw(400, 'Invalid PGP key: invalid user ids'); } + // get algorithm details from primary key + const keyInfo = key.primaryKey.getAlgorithmInfo(); + // public key document that is stored in the database return { keyId, @@ -73,8 +76,8 @@ class PGP { userIds, created: primaryKey.created, uploaded: new Date(), - algorithm: primaryKey.algorithm, - keySize: primaryKey.getBitSize(), + algorithm: keyInfo.algorithm, + keySize: keyInfo.bits, publicKeyArmored }; } @@ -110,20 +113,15 @@ class PGP { * @param {Array} users A list of openpgp.js user objects * @return {Array} An array of user id objects */ - parseUserIds(users, primaryKey) { + async parseUserIds(users, primaryKey) { if (!users || !users.length) { util.throw(400, 'Invalid PGP key: no user id found'); } - // at least one user id signature must be valid + // at least one user id must be valid, revoked or expired const result = []; for (const user of users) { - let oneValid = false; - for (const cert of user.selfCertifications) { - if (user.isValidSelfCertificate(primaryKey, cert)) { - oneValid = true; - } - } - if (oneValid && user.userId && user.userId.userid) { + const userStatus = await user.verify(primaryKey); + if (userStatus !== openpgp.enums.keyStatus.invalid && user.userId && user.userId.userid) { const uid = addressparser(user.userId.userid)[0]; if (util.isEmail(uid.address)) { result.push(uid); diff --git a/src/service/public-key.js b/src/service/public-key.js index a311081..ce91ca6 100644 --- a/src/service/public-key.js +++ b/src/service/public-key.js @@ -70,7 +70,7 @@ class PublicKey { // lazily purge old/unverified keys on every key upload await this._purgeOldUnverified(); // parse key block - const key = this._pgp.parseKey(publicKeyArmored); + const key = await this._pgp.parseKey(publicKeyArmored); // check for existing verified key with same id const verified = await this.getVerified({keyId: key.keyId}); if (verified) {