[pve-devel] [PATCH pmg-api 8/8] cli: acme: expose acme eab options on the cli

[Folke Gleumes <f.gleumes@proxmox.com>]

interactively ask for external account binding credentials if either:
* the ca requests it
* a custom ca is used

Signed-off-by: Folke Gleumes <f.gleumes@proxmox.com>
---
 src/PMG/CLI/pmgconfig.pm | 29 ++++++++++++++++++++++++++---
 1 file changed, 26 insertions(+), 3 deletions(-)

diff --git a/src/PMG/CLI/pmgconfig.pm b/src/PMG/CLI/pmgconfig.pm
index cc036fa..2a7a7a1 100644
--- a/src/PMG/CLI/pmgconfig.pm
+++ b/src/PMG/CLI/pmgconfig.pm
@@ -244,6 +244,7 @@ __PACKAGE__->register_method({
     code => sub {
 	my ($param) = @_;
 
+	my $custom_directory = 1;
 	if (!$param->{directory}) {
 	    my $directories = PMG::API2::ACME->get_directories({});
 	    print "Directory endpoints:\n";
@@ -264,6 +265,7 @@ __PACKAGE__->register_method({
 			return;
 		    } elsif ($selection < $i && $selection >= 0) {
 			$param->{directory} = $directories->[$selection]->{url};
+			$custom_directory = 0;
 			return;
 		    }
 		}
@@ -277,11 +279,13 @@ __PACKAGE__->register_method({
 		$attempts++;
 	    }
 	}
+
 	print "\nAttempting to fetch Terms of Service from '$param->{directory}'..\n";
-	my $tos = PMG::API2::ACME->get_tos({ directory => $param->{directory} });
-	if ($tos) {
+	my $meta = PMG::API2::ACME->get_meta({ directory => $param->{directory} });
+	if ($meta->{termsOfService}) {
+	    my $tos = $meta->{termsOfService};
 	    print "Terms of Service: $tos\n";
-	    my $term = Term::ReadLine->new('pvenode');
+	    my $term = Term::ReadLine->new('pmgconfig');
 	    my $agreed = $term->readline('Do you agree to the above terms? [y|N]: ');
 	    die "Cannot continue without agreeing to ToS, aborting.\n"
 		if ($agreed !~ /^y$/i);
@@ -290,6 +294,25 @@ __PACKAGE__->register_method({
 	} else {
 	    print "No Terms of Service found, proceeding.\n";
 	}
+
+	my $eab_enabled = $meta->{externalAccountRequired};
+	if (!$eab_enabled && $custom_directory) {
+	    my $term = Term::ReadLine->new('pmgconfig');
+	    my $agreed = $term->readline('Do you want to use external account binding? [y|N]: ');
+	    $eab_enabled = ($agreed =~ /^y$/i);
+	} elsif ($eab_enabled) {
+	    print "The CA requires external account binding.\n";
+	}
+	if ($eab_enabled) {
+	    print "You should have received a key id and a key from your CA.\n";
+	    my $term = Term::ReadLine->new('pmgconfig');
+	    my $eab_kid = $term->readline('Enter EAB key id: ');
+	    my $eab_hmac_key = $term->readline('Enter EAB key: ');
+
+	    $param->{'eab-kid'} = $eab_kid;
+	    $param->{'eab-hmac-key'} = $eab_hmac_key;
+	}
+
 	print "\nAttempting to register account with '$param->{directory}'..\n";
 
 	$upid_exit->(PMG::API2::ACME->register_account($param));
-- 
2.39.2