api: merge v3 proofs and add host approval pages and listener

host/src/api/ssh.rs

@@ -19,13 +19,13 @@ pub(super) fn handle(ctx: &Api<'_>, caller: &Caller, action: &str, body: &Value)
     if action == "sign" && string(body, "item")? != item.id {
         return Err(Error(403, "item_mismatch"));
     }
-    let prepared = if item.free_use {
-        Some((None, cred.credential(&item, true)?))
+    let event = if action == "sign" {
+        "ssh.sign.pending"
     } else {
-        cred.prepare_use(&item, caller, action == "sign")?
-            .map(|(grant, values)| (Some(grant), values))
+        "ssh.identity.pending"
     };
-    let Some((grant, values)) = prepared else {
+    let prepared = cred.prepare_use(&item, caller, action == "sign", event)?;
+    let Some((grant, values, audit_id)) = prepared else {
         ctx.rate_limit(caller)?;
         let request = cred.file_request(
             caller,
@@ -50,7 +50,8 @@ pub(super) fn handle(ctx: &Api<'_>, caller: &Caller, action: &str, body: &Value)
     .into_iter()
     .flatten()
     {
-        let output = cred::v8::V8
+        let output = ctx
+            .script
             .evaluate(source, &context.to_string(), None, Default::default())
             .map_err(|_| Error(403, "validator_denied"))?;
         let output: Value =
@@ -76,6 +77,13 @@ pub(super) fn handle(ctx: &Api<'_>, caller: &Caller, action: &str, body: &Value)
     if action == "identity" {
         let public_key = cred::sign::public_key(secret, None, format, "ssh")
             .map_err(|_| Error(400, "invalid_key"))?;
+        cred.access()?
+            .db
+            .execute(
+                "UPDATE audit SET event='ssh.identity' WHERE id=?",
+                [audit_id],
+            )
+            .map_err(cred::Error::from)?;
         Ok(
             json!({"item":item.id,"public_key":public_key,"user":public.get("user").and_then(Value::as_str)}),
         )
@@ -90,7 +98,13 @@ pub(super) fn handle(ctx: &Api<'_>, caller: &Caller, action: &str, body: &Value)
         };
         let signature = cred::sign::sign(secret, None, format, &payload, "ssh", padding, hash)
             .map_err(|_| Error(400, "sign_failed"))?;
-        cred.audit_sign(&item.id, caller, &payload)?;
+        cred.access()?
+            .db
+            .execute(
+                "UPDATE audit SET event='sign',payload_sha256=?1 WHERE id=?2",
+                rusqlite::params![cred::webauthn::digest(&payload), audit_id],
+            )
+            .map_err(cred::Error::from)?;
         Ok(json!({"signature":signature.signature}))
     }
 }