feat(target): add proxy certificate repos and protos (#1577)

internal/session/session.go

@@ -608,3 +608,62 @@ type deletedSession struct {
 func (s *deletedSession) TableName() string {
 	return "session_deleted"
 }
+
+// ProxyCertificate represents a session id to proxy certificate mapping
+// It's stored during session authorization and used at connection authorization
+// time to lookup the proxy certificate, if applicable
+type ProxyCertificate struct {
+	SessionId   string `gorm:"not_null"`
+	Certificate []byte `gorm:"not_null"`
+}
+
+// NewProxyCertificate creates a new in memory ProxyCertificate
+func NewProxyCertificate(ctx context.Context, sessionId string, certificate []byte) (*ProxyCertificate, error) {
+	const op = "session.NewProxyCertificate"
+	switch {
+	case sessionId == "":
+		return nil, errors.New(ctx, errors.InvalidParameter, op, "missing session id")
+	case len(certificate) == 0:
+		return nil, errors.New(ctx, errors.InvalidParameter, op, "missing certificate")
+	}
+
+	return &ProxyCertificate{
+		SessionId:   sessionId,
+		Certificate: certificate,
+	}, nil
+}
+
+func alloProxyCertificate() *ProxyCertificate {
+	return &ProxyCertificate{}
+}
+
+// Clone creates a clone of the ProxyCertificate
+func (t *ProxyCertificate) Clone() *ProxyCertificate {
+	spc := &ProxyCertificate{
+		SessionId: t.SessionId,
+	}
+	if t.Certificate != nil {
+		spc.Certificate = make([]byte, len(t.Certificate))
+		copy(spc.Certificate, t.Certificate)
+	}
+
+	return spc
+}
+
+// VetForWrite implements db.VetForWrite() interface and validates the session proxy certificate
+func (t *ProxyCertificate) VetForWrite(ctx context.Context, _ db.Reader, opType db.OpType, _ ...db.Option) error {
+	const op = "session.(ProxyCertificate).VetForWrite"
+	switch {
+	case t.SessionId == "":
+		return errors.New(ctx, errors.InvalidParameter, op, "missing session id")
+	case len(t.Certificate) == 0:
+		return errors.New(ctx, errors.InvalidParameter, op, "missing certificate")
+	}
+
+	return nil
+}
+
+// TableName returns the table name.
+func (t *ProxyCertificate) TableName() string {
+	return "session_proxy_certificate"
+}

internal/session/session_test.go

@@ -433,3 +433,63 @@ func Test_newCert(t *testing.T) {
 		assert.Equal(t, parsedCert.PublicKey.(crypto.PublicKey), ed25519.PrivateKey(key).Public())
 	})
 }
+
+func TestProxyCertificate(t *testing.T) {
+	t.Parallel()
+	ctx := context.Background()
+
+	sId := "test-session-id"
+	cert := make([]byte, 20)
+	if _, err := rand.Read(cert); err != nil {
+		require.NotNil(t, err)
+	}
+
+	tests := []struct {
+		name            string
+		sessionId       string
+		certificate     []byte
+		expected        *ProxyCertificate
+		wantErr         bool
+		wantErrContains string
+	}{
+		{
+			name:        "valid-target-cert",
+			sessionId:   sId,
+			certificate: cert,
+			expected: &ProxyCertificate{
+				SessionId:   sId,
+				Certificate: cert,
+			},
+		},
+		{
+			name:            "missing-session-id",
+			certificate:     cert,
+			wantErr:         true,
+			wantErrContains: "missing session id",
+		},
+		{
+			name:            "missing-cert",
+			sessionId:       sId,
+			wantErr:         true,
+			wantErrContains: "missing certificate",
+		},
+	}
+
+	for _, tt := range tests {
+		tt := tt
+		t.Run(tt.name, func(t *testing.T) {
+			assert, require := assert.New(t), require.New(t)
+
+			gotCert, err := NewProxyCertificate(ctx, tt.sessionId, tt.certificate)
+
+			if tt.wantErr {
+				assert.Error(err)
+				return
+			}
+			require.NoError(err)
+			require.NotNil(gotCert)
+			assert.Equal(tt.expected.SessionId, gotCert.SessionId)
+			assert.Equal(tt.expected.Certificate, gotCert.Certificate)
+		})
+	}
+}