feat: move step-ca into a plugin (C4)

src/backend/database/routes/host-compat-routes.ts

@@ -1,8 +1,8 @@
 /**
  * The 2.8 URLs under /host that something outside Termix still depends on:
- * the OPKSSH redirect URI registered with identity providers. It forwards to
- * the plugin route that replaced it, so with the plugin off it signs nobody
- * in.
+ * the OPKSSH and Step CA redirect URIs registered with identity providers.
+ * Each forwards to the plugin route that replaced it, so with the plugin off
+ * it signs nobody in.
  */
 
 import type { Request, Router } from "express";
@@ -33,4 +33,20 @@ export function registerHostAuthCompatRoutes(router: Router): void {
     const rest = req.path.slice("/opkssh-callback".length);
     res.redirect(307, localUrl(req, `/plugin-api/opkssh/callback${rest}`));
   });
+
+  /**
+   * @openapi
+   * /host/step-ca-callback:
+   *   get:
+   *     summary: Step CA callback (2.8 URL)
+   *     description: The redirect URI Step CA identity providers were set up with before 2.9. Redirects to /plugin-api/step-ca/callback with the same query, so existing provider configurations keep working.
+   *     tags:
+   *       - Auth
+   *     responses:
+   *       307:
+   *         description: Redirect to the step-ca plugin's callback.
+   */
+  router.get("/step-ca-callback", (req, res) => {
+    res.redirect(307, localUrl(req, "/plugin-api/step-ca/callback"));
+  });
 }

src/backend/database/routes/host-step-ca-routes.ts

@@ -1,42 +0,0 @@
-import type { Request, Response, Router } from "express";
-
-function escapeHtml(value: string): string {
-  return value
-    .replace(/&/g, "&")
-    .replace(/</g, "&lt;")
-    .replace(/>/g, "&gt;")
-    .replace(/"/g, "&quot;")
-    .replace(/'/g, "&#39;");
-}
-
-function resultPage(ok: boolean, message: string): string {
-  return `<!doctype html><html><head><meta charset="utf-8"><title>Termix</title>
-<style>body{font-family:system-ui,sans-serif;background:#111;color:#eee;display:flex;align-items:center;justify-content:center;height:100vh;margin:0}
-main{max-width:28rem;padding:2rem;border:1px solid #333;background:#181818}h1{font-size:1.1rem;margin:0 0 .5rem}p{margin:0;color:#aaa}</style></head>
-<body><main><h1>${ok ? "Signed in" : "Sign-in failed"}</h1><p>${escapeHtml(message)}</p></main></body></html>`;
-}
-
-/**
- * The OIDC redirect target for Step CA sign-ins. Unauthenticated on purpose:
- * the browser that finishes the sign-in may not be the one running Termix,
- * so the request is matched to its session by the OAuth state.
- */
-export function registerHostStepCaRoutes(router: Router): void {
-  router.get("/step-ca-callback", async (req: Request, res: Response) => {
-    const { completeStepCaAuth } = await import("../../hosts/step-ca-auth.js");
-    const stringQuery = (name: string): string | undefined => {
-      const value = req.query[name];
-      return typeof value === "string" ? value : undefined;
-    };
-    const result = await completeStepCaAuth({
-      state: stringQuery("state"),
-      code: stringQuery("code"),
-      error: stringQuery("error"),
-      error_description: stringQuery("error_description"),
-    });
-    res
-      .status(result.ok ? 200 : 400)
-      .type("html")
-      .send(resultPage(result.ok, result.message));
-  });
-}

src/backend/database/routes/host.ts

@@ -46,7 +46,6 @@ import {
 } from "./host-plugin-settings.js";
 import { validateParentHostId } from "./host-parent-validation.js";
 import { registerHostAuthCompatRoutes } from "./host-compat-routes.js";
-import { registerHostStepCaRoutes } from "./host-step-ca-routes.js";
 import { registerHostFolderRoutes } from "./host-folder-routes.js";
 import { registerHostAutostartRoutes } from "./host-autostart-routes.js";
 import { registerHostInternalRoutes } from "./host-internal-routes.js";
@@ -2661,7 +2660,6 @@ registerHostAutostartRoutes(router, {
 });
 
 registerHostAuthCompatRoutes(router);
-registerHostStepCaRoutes(router);
 
 registerHostNetworkRoutes(router, {
   authenticateJWT,

src/backend/database/routes/user-settings-routes.ts

@@ -1,5 +1,4 @@
 import type { AuthenticatedRequest } from "../../../types/index.js";
-import { getErrorMessage } from "../../utils/error-message.js";
 import type { RequestHandler, Router } from "express";
 import {
   authLogger,
@@ -13,7 +12,6 @@ import {
   AUDIT_FORWARD_URL_SETTING,
 } from "../../utils/audit-forwarder.js";
 import { getTelemetryEnvOverride } from "../../utils/analytics.js";
-import { STEP_CA_PRIVATE_ALLOWLIST_KEY } from "../../utils/step-ca-egress.js";
 import {
   NOTIFICATION_PRIVATE_ALLOWLIST_KEY,
   parseNotificationAllowlist,
@@ -464,7 +462,7 @@ export function registerUserSettingsRoutes(
 
   /**
    * GET/PATCH a comma-list of private hosts an outbound feature may reach.
-   * Shared by notifications and Step CA; each keeps its own setting key.
+   * One route pair per private endpoint allowlist, each with its own setting key.
    */
   const registerPrivateEndpointAllowlist = (
     path: string,
@@ -562,131 +560,6 @@ export function registerUserSettingsRoutes(
     "notification endpoint",
   );
 
-  /**
-   * @openapi
-   * /users/step-ca-private-endpoints:
-   *   get:
-   *     summary: Get the private hosts the Step CA certificate flow may contact (admin only)
-   *     tags:
-   *       - Users
-   *   patch:
-   *     summary: Replace that allowlist (admin only)
-   *     tags:
-   *       - Users
-   */
-  registerPrivateEndpointAllowlist(
-    "/step-ca-private-endpoints",
-    STEP_CA_PRIVATE_ALLOWLIST_KEY,
-    "update_step_ca_private_endpoints",
-    "Step CA endpoint",
-  );
-
-  /**
-   * @openapi
-   * /users/step-ca-settings:
-   *   get:
-   *     summary: Step CA settings. Admins get the values; everyone else only whether it is configured.
-   *     tags:
-   *       - Users
-   *   patch:
-   *     summary: Set the Step CA URL, root fingerprint and OIDC provisioner (admin only). Empty values clear the configuration.
-   *     tags:
-   *       - Users
-   */
-  router.get("/step-ca-settings", authenticateJWT, async (req, res) => {
-    const userId = (req as AuthenticatedRequest).userId;
-    try {
-      const { readStepCaSettings } =
-        await import("../../hosts/step-ca-auth.js");
-      const settings = await readStepCaSettings();
-      if (!(await getAdminActor(userId))) {
-        return res.json({ configured: settings !== null });
-      }
-      res.json({
-        configured: settings !== null,
-        caUrl: settings?.caUrl ?? "",
-        fingerprint: settings?.fingerprint ?? "",
-        provisioner: settings?.provisioner ?? "",
-      });
-    } catch (err) {
-      authLogger.error("Failed to get Step CA settings", err);
-      res.status(500).json({ error: "Failed to get Step CA settings" });
-    }
-  });
-
-  router.patch("/step-ca-settings", authenticateJWT, async (req, res) => {
-    const userId = (req as AuthenticatedRequest).userId;
-    try {
-      const actor = await getAdminActor(userId);
-      if (!actor) {
-        return res.status(403).json({ error: "Not authorized" });
-      }
-      const { caUrl, fingerprint, provisioner } = req.body ?? {};
-      if (
-        [caUrl, fingerprint, provisioner].some((v) => typeof v !== "string")
-      ) {
-        return res.status(400).json({
-          error: "caUrl, fingerprint and provisioner must be strings",
-        });
-      }
-      const values = {
-        caUrl: caUrl.trim(),
-        fingerprint: fingerprint.trim(),
-        provisioner: provisioner.trim(),
-      };
-      const clearing =
-        !values.caUrl && !values.fingerprint && !values.provisioner;
-      if (!clearing) {
-        const { normalizeCaUrl, normalizeFingerprint } =
-          await import("../../utils/step-ca-client.js");
-        try {
-          values.caUrl = normalizeCaUrl(values.caUrl);
-          values.fingerprint = normalizeFingerprint(values.fingerprint);
-        } catch (err) {
-          return res.status(400).json({ error: getErrorMessage(err) });
-        }
-        if (!values.provisioner) {
-          return res.status(400).json({ error: "provisioner is required" });
-        }
-      }
-
-      const { STEP_CA_SETTING_KEYS } =
-        await import("../../hosts/step-ca-auth.js");
-      const settings = createCurrentSettingsRepository();
-      if (clearing) {
-        await settings.delete(STEP_CA_SETTING_KEYS.url);
-        await settings.delete(STEP_CA_SETTING_KEYS.fingerprint);
-        await settings.delete(STEP_CA_SETTING_KEYS.provisioner);
-      } else {
-        await settings.set(STEP_CA_SETTING_KEYS.url, values.caUrl);
-        await settings.set(
-          STEP_CA_SETTING_KEYS.fingerprint,
-          values.fingerprint,
-        );
-        await settings.set(
-          STEP_CA_SETTING_KEYS.provisioner,
-          values.provisioner,
-        );
-      }
-
-      const { ipAddress, userAgent } = getRequestMeta(req);
-      await logAudit({
-        userId,
-        username: actor.username ?? userId,
-        action: "update_step_ca_settings",
-        resourceType: "setting",
-        details: JSON.stringify({ configured: !clearing, caUrl: values.caUrl }),
-        ipAddress,
-        userAgent,
-        success: true,
-      });
-      res.json({ configured: !clearing, ...values });
-    } catch (err) {
-      authLogger.error("Failed to update Step CA settings", err);
-      res.status(500).json({ error: "Failed to update Step CA settings" });
-    }
-  });
-
   /**
    * @openapi
    * /users/host-defaults: