Added endpoints for creating and downloading api user certificates

app/controllers/admin/certificates_controller.rb

@@ -1,10 +1,9 @@
 module Admin
   class CertificatesController < BaseController
     load_and_authorize_resource
-    before_action :set_certificate, :set_api_user, only: [:sign, :show, :download_csr, :download_crt, :revoke, :destroy]
+    before_action :set_certificate, :set_api_user, only: %i[sign show download_csr download_crt revoke destroy]
 
-    def show;
-    end
+    def show; end
 
     def new
       @api_user = ApiUser.find(params[:api_user_id])
@@ -28,11 +27,9 @@ def create
     end
 
     def destroy
-      if @certificate.interface == Certificate::REGISTRAR
-        @certificate.revoke!
-      end
+      success = @certificate.revokable? ? revoke_and_destroy_certificate : @certificate.destroy
 
-      if @certificate.destroy
+      if success
         flash[:notice] = I18n.t('record_deleted')
         redirect_to admin_registrar_api_user_path(@api_user.registrar, @api_user)
       else
@@ -42,8 +39,9 @@ def destroy
     end
 
     def sign
-      if @certificate.sign!
+      if @certificate.sign!(password: certificate_params[:password])
         flash[:notice] = I18n.t('record_updated')
+        notify_api_user
         redirect_to [:admin, @api_user, @certificate]
       else
         flash.now[:alert] = I18n.t('failed_to_update_record')
@@ -52,7 +50,7 @@ def sign
     end
 
     def revoke
-      if @certificate.revoke!
+      if @certificate.revoke!(password: certificate_params[:password])
         flash[:notice] = I18n.t('record_updated')
       else
         flash[:alert] = I18n.t('failed_to_update_record')
@@ -84,10 +82,22 @@ def set_api_user
 
     def certificate_params
       if params[:certificate]
-        params.require(:certificate).permit(:crt, :csr)
+        params.require(:certificate).permit(:crt, :csr, :password)
       else
         {}
       end
     end
+
+    def notify_api_user
+      api_user_email = @api_user.registrar.email
+
+      CertificateMailer.signed(email: api_user_email, api_user: @api_user,
+                               crt: OpenSSL::X509::Certificate.new(@certificate.crt))
+                       .deliver_now
+    end
+
+    def revoke_and_destroy_certificate
+      @certificate.revoke!(password: certificate_params[:password]) && @certificate.destroy
+    end
   end
 end

app/controllers/repp/v1/api_users_controller.rb

@@ -2,6 +2,7 @@
 module Repp
   module V1
     class ApiUsersController < BaseController
+      before_action :find_api_user, only: %i[show update destroy]
       load_and_authorize_resource
 
       THROTTLED_ACTIONS = %i[index show create update destroy].freeze
@@ -60,6 +61,10 @@ def destroy
 
       private
 
+      def find_api_user
+        @api_user = current_user.registrar.api_users.find(params[:id])
+      end
+
       def api_user_params
         params.require(:api_user).permit(:username, :plain_text_password, :active,
                                          :identity_code, { roles: [] })

app/controllers/repp/v1/certificates_controller.rb

@@ -1,29 +1,52 @@
+require 'serializers/repp/certificate'
 module Repp
   module V1
     class CertificatesController < BaseController
-      THROTTLED_ACTIONS = %i[create].freeze
+      before_action :find_certificate, only: %i[show download]
+      load_and_authorize_resource param_method: :cert_params
+
+      THROTTLED_ACTIONS = %i[show create download].freeze
       include Shunter::Integration::Throttle
 
+      api :GET, '/repp/v1/api_users/:api_user_id/certificates/:id'
+      desc "Get a specific api user's specific certificate data"
+      def show
+        serializer = Serializers::Repp::Certificate.new(@certificate)
+        render_success(data: { cert: serializer.to_json })
+      end
+
       api :POST, '/repp/v1/certificates'
       desc 'Submit a new api user certificate signing request'
       def create
-        authorize! :create, Certificate
         @api_user = current_user.registrar.api_users.find(cert_params[:api_user_id])
 
         csr = decode_cert_params(cert_params[:csr])
 
         @certificate = @api_user.certificates.build(csr: csr)
-        unless @certificate.save
+
+        if @certificate.save
+          notify_admins
+          render_success(data: { api_user: { id: @api_user.id } })
+        else
           handle_non_epp_errors(@certificate)
-          return
         end
+      end
 
-        notify_admins
-        render_success(data: { api_user: { id: @api_user.id } })
+      api :get, '/repp/v1/api_users/:api_user_id/certificates/:id/download'
+      desc "Download a specific api user's specific certificate"
+      param :type, String, required: true, desc: 'Type of certificate (csr or crt)'
+      def download
+        filename = "#{@api_user.username}_#{Time.zone.today.strftime('%y%m%d')}_portal.#{params[:type]}.pem"
+        send_data @certificate[params[:type].to_s], filename: filename
       end
 
       private
 
+      def find_certificate
+        @api_user = current_user.registrar.api_users.find(params[:api_user_id])
+        @certificate = @api_user.certificates.find(params[:id])
+      end
+
       def cert_params
         params.require(:certificate).permit(:api_user_id, csr: %i[body type])
       end
@@ -40,9 +63,9 @@ def notify_admins
         return if admin_users_emails.empty?
 
         admin_users_emails.each do |email|
-          CertificateMailer.new_certificate_signing_request(email: email,
-                                                            api_user: @api_user,
-                                                            csr: @certificate)
+          CertificateMailer.certificate_signing_requested(email: email,
+                                                          api_user: @api_user,
+                                                          csr: @certificate)
                            .deliver_now
         end
       end

app/controllers/repp/v1/invoices_controller.rb

@@ -2,6 +2,7 @@
 module Repp
   module V1
     class InvoicesController < BaseController # rubocop:disable Metrics/ClassLength
+      before_action :find_invoice, only: %i[show download send_to_recipient cancel]
       load_and_authorize_resource
 
       THROTTLED_ACTIONS = %i[download add_credit send_to_recipient cancel index show].freeze
@@ -35,8 +36,6 @@ def show
       desc 'Download a specific invoice as pdf file'
       def download
         filename = "Invoice-#{@invoice.number}.pdf"
-        @response = { code: 1000, message: 'Command completed successfully',
-                      data: filename }
         send_data @invoice.as_pdf, filename: filename
       end
 
@@ -91,6 +90,10 @@ def add_credit
 
       private
 
+      def find_invoice
+        @invoice = current_user.registrar.invoices.find(params[:id])
+      end
+
       def index_params
         params.permit(:id, :limit, :offset, :details, :q, :simple,
                       :page, :per_page,

app/controllers/repp/v1/white_ips_controller.rb

@@ -1,6 +1,7 @@
 module Repp
   module V1
     class WhiteIpsController < BaseController
+      before_action :find_white_ip, only: %i[show update destroy]
       load_and_authorize_resource
 
       THROTTLED_ACTIONS = %i[index show create update destroy].freeze
@@ -57,6 +58,10 @@ def destroy
 
       private
 
+      def find_white_ip
+        @white_ip = current_user.registrar.white_ips.find(params[:id])
+      end
+
       def white_ip_params
         params.require(:white_ip).permit(:ipv4, :ipv6, interfaces: [])
       end

app/mailers/certificate_mailer.rb

@@ -1,8 +1,15 @@
 class CertificateMailer < ApplicationMailer
-  def new_certificate_signing_request(email:, api_user:, csr:)
+  def certificate_signing_requested(email:, api_user:, csr:)
     @certificate = csr
     @api_user = api_user
     subject = 'New Certificate Signing Request Received'
     mail(to: email, subject: subject)
   end
+
+  def signed(email:, api_user:, crt:)
+    @crt = crt
+    @api_user = api_user
+    subject = "Certificate Signing Confirmation for API User '#{@api_user.username}'"
+    mail(to: email, subject: subject)
+  end
 end

app/models/ability.rb

@@ -30,7 +30,7 @@ def super # Registrar/api_user dynamic role
     billing
     can :manage, ApiUser
     can :manage, WhiteIp
-    can :create, Certificate
+    can :manage, Certificate
   end
 
   def epp # Registrar/api_user dynamic role