Initialize modular NPM ACME authority patcher

functions/__init__.py

@@ -0,0 +1 @@
+"""NPM ACME authority mutation modules."""

functions/common.py

@@ -0,0 +1,83 @@
+"""
+Shared helpers for NPM ACME authority mutations.
+"""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+from pathlib import Path
+import os
+
+
+AUTHORITY_FILE = "/acme_authority/state/acme-authority"
+
+
+@dataclass(frozen=True)
+class GateConfig:
+    request: bool
+    renew: bool
+    revoke: bool
+
+    @property
+    def any_enabled(self) -> bool:
+        return self.request or self.renew or self.revoke
+
+
+def log(message: str) -> None:
+    print(f"[acme-authority] {message}", flush=True)
+
+
+def env_bool(name: str, default: bool = False) -> bool:
+    value = os.environ.get(name)
+
+    if value is None:
+        return default
+
+    value = value.strip().lower()
+
+    if value in {"1", "true", "yes", "on"}:
+        return True
+
+    if value in {"0", "false", "no", "off"}:
+        return False
+
+    raise RuntimeError(
+        f"{name} must be true/false, yes/no, on/off, or 1/0; got {value!r}"
+    )
+
+
+def load_config() -> GateConfig:
+    return GateConfig(
+        request=env_bool("ACME_GATE_REQUEST"),
+        renew=env_bool("ACME_GATE_RENEW"),
+        revoke=env_bool("ACME_GATE_REVOKE"),
+    )
+
+
+def load_source(path: Path) -> str:
+    if not path.is_file():
+        raise RuntimeError(f"NPM certificate source not found: {path}")
+
+    return path.read_text()
+
+
+def write_source(path: Path, source: str) -> None:
+    path.write_text(source)
+
+
+def apply_authority_helper(source: str) -> str:
+    """
+    Install the common requireAcmeAuthority() helper.
+
+    Implemented in the next development step.
+    """
+    raise NotImplementedError("authority helper mutation not implemented yet")
+
+
+def verify(source: str, config: GateConfig) -> None:
+    """
+    Verify every requested mutation before certificate.js is written.
+
+    Implemented after the individual mutation modules.
+    """
+    raise NotImplementedError("patch verification not implemented yet")

functions/renew.py

@@ -0,0 +1,12 @@
+"""
+Let's Encrypt certificate renewal gate.
+"""
+
+from __future__ import annotations
+
+
+def apply(source: str) -> str:
+    """
+    Gate internalCertificate.renew() before renewal dispatch.
+    """
+    raise NotImplementedError("renew gate not implemented yet")

functions/request.py

@@ -0,0 +1,12 @@
+"""
+Let's Encrypt certificate request/create gate.
+"""
+
+from __future__ import annotations
+
+
+def apply(source: str) -> str:
+    """
+    Gate NPM create() for provider == letsencrypt before DB insertion.
+    """
+    raise NotImplementedError("request gate not implemented yet")

functions/revoke.py

@@ -0,0 +1,14 @@
+"""
+Let's Encrypt certificate delete/revoke gates.
+"""
+
+from __future__ import annotations
+
+
+def apply(source: str) -> str:
+    """
+    Install both:
+      - delete() pre-database-mutation authority gate
+      - revokeLetsEncryptSsl() execution authority gate
+    """
+    raise NotImplementedError("revoke gate not implemented yet")