[pbs-devel] [PATCH proxmox] acme: directory: make non-required url fields optional

[Christian Ebner]

ACME servers provide the directory endpoint for clients to discover
the URLs for ACME operation. These fields are described in RFC 8555
[0], but section 7.1 of the corresponding RFC [1] states that the
server is only required to provide the `directory` and `newNonce`
resources.

Therefore, make the not explicitly required fields optional to not
fail during deserialization of the json response and improve error
handling when the acme client actually requires the not-provided
operation url.

This was discovered based on issues reported in the community forum.

[0] https://www.rfc-editor.org/rfc/rfc8555#section-7.1.1
[1] https://www.rfc-editor.org/rfc/rfc8555#section-7.1

Fixes: https://forum.proxmox.com/threads/159987/
Signed-off-by: Christian Ebner <c.ebner at proxmox.com>
---
 proxmox-acme/src/account.rs   | 14 ++++++++++----
 proxmox-acme/src/directory.rs | 20 ++++++++++++--------
 2 files changed, 22 insertions(+), 12 deletions(-)

diff --git a/proxmox-acme/src/account.rs b/proxmox-acme/src/account.rs
index 6993b2cf..d5e2df88 100644
--- a/proxmox-acme/src/account.rs
+++ b/proxmox-acme/src/account.rs
@@ -69,7 +69,9 @@ impl Account {
             return Err(Error::EmptyOrder);
         }
 
-        let url = directory.new_order_url();
+        let url = directory
+            .new_order_url()
+            .ok_or_else(|| Error::Custom("no 'newOrder' URL specified by provider".to_string()))?;
         let body = serde_json::to_string(&Jws::new(
             &key,
             Some(self.location.clone()),
@@ -273,8 +275,10 @@ pub struct CertificateRevocation<'a> {
 impl CertificateRevocation<'_> {
     /// Create the revocation request using the specified nonce for the given directory.
     pub fn request(&self, directory: &Directory, nonce: &str) -> Result<Request, Error> {
-        self.account
-            .post_request(&directory.data.revoke_cert, nonce, &self.data)
+        let revoke_cert = directory.data.revoke_cert.as_ref().ok_or_else(|| {
+            Error::Custom("no 'revokeCert' URL specified by provider".to_string())
+        })?;
+        self.account.post_request(revoke_cert, nonce, &self.data)
     }
 }
 
@@ -362,7 +366,9 @@ impl AccountCreator {
     /// [`response`](AccountCreator::response()) will render the account unusable!
     pub fn request(&self, directory: &Directory, nonce: &str) -> Result<Request, Error> {
         let key = self.key.as_deref().ok_or(Error::MissingKey)?;
-        let url = directory.new_account_url();
+        let url = directory.new_account_url().ok_or_else(|| {
+            Error::Custom("no 'newAccount' URL specified by provider".to_string())
+        })?;
 
         let external_account_binding = self
             .eab_credentials
diff --git a/proxmox-acme/src/directory.rs b/proxmox-acme/src/directory.rs
index ed8203f9..b940901a 100644
--- a/proxmox-acme/src/directory.rs
+++ b/proxmox-acme/src/directory.rs
@@ -20,19 +20,23 @@ pub struct Directory {
 #[serde(rename_all = "camelCase")]
 pub struct DirectoryData {
     /// The entry point to create a new account.
-    pub new_account: String,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub new_account: Option<String>,
 
     /// The entry point to retrieve a new nonce, should be used with a `HEAD` request.
     pub new_nonce: String,
 
     /// URL to post new orders to.
-    pub new_order: String,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub new_order: Option<String>,
 
     /// URL to use for certificate revocation.
-    pub revoke_cert: String,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub revoke_cert: Option<String>,
 
     /// Account key rollover URL.
-    pub key_change: String,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub key_change: Option<String>,
 
     /// Metadata object, for additional information which aren't directly part of the API
     /// itself, such as the terms of service.
@@ -92,12 +96,12 @@ impl Directory {
         &self.data.new_nonce
     }
 
-    pub(crate) fn new_account_url(&self) -> &str {
-        &self.data.new_account
+    pub(crate) fn new_account_url(&self) -> Option<&str> {
+        self.data.new_account.as_deref()
     }
 
-    pub(crate) fn new_order_url(&self) -> &str {
-        &self.data.new_order
+    pub(crate) fn new_order_url(&self) -> Option<&str> {
+        self.data.new_order.as_deref()
     }
 
     /// Access to the in the Acme spec defined metadata structure.
-- 
2.39.5