regenerate secret for wireguard

server/routers/site/reGenerateSiteSecret.ts

@@ -1,6 +1,6 @@
 import { Request, Response, NextFunction } from "express";
 import { z } from "zod";
-import { db, newts } from "@server/db";
+import { db, newts, sites } from "@server/db";
 import { eq } from "drizzle-orm";
 import response from "@server/lib/response";
 import HttpCode from "@server/types/HttpCode";
@@ -9,6 +9,8 @@ import logger from "@server/logger";
 import { fromError } from "zod-validation-error";
 import { OpenAPITags, registry } from "@server/openApi";
 import { hashPassword } from "@server/auth/password";
+import { addPeer } from "../gerbil/peers";
+
 
 const updateSiteParamsSchema = z
     .object({
@@ -18,28 +20,31 @@ const updateSiteParamsSchema = z
 
 const updateSiteBodySchema = z
     .object({
+        type: z.enum(["newt", "wireguard"]),
         newtId: z.string().min(1).max(255).optional(),
         newtSecret: z.string().min(1).max(255).optional(),
+        exitNodeId: z.number().int().positive().optional(),
+        pubKey: z.string().optional(),
+        subnet: z.string().optional(),
     })
     .strict();
 
 registry.registerPath({
     method: "post",
     path: "/site/{siteId}/regenerate-secret",
-    description:
-        "Regenerate a site's Newt credentials by its site ID.",
+    description: "Regenerate a site's Newt or WireGuard credentials by its site ID.",
     tags: [OpenAPITags.Site],
     request: {
         params: updateSiteParamsSchema,
         body: {
             content: {
                 "application/json": {
-                    schema: updateSiteBodySchema
-                }
-            }
-        }
+                    schema: updateSiteBodySchema,
+                },
+            },
+        },
     },
-    responses: {}
+    responses: {},
 });
 
 export async function reGenerateSiteSecret(
@@ -51,56 +56,100 @@ export async function reGenerateSiteSecret(
         const parsedParams = updateSiteParamsSchema.safeParse(req.params);
         if (!parsedParams.success) {
             return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    fromError(parsedParams.error).toString()
-                )
+                createHttpError(HttpCode.BAD_REQUEST, fromError(parsedParams.error).toString())
             );
         }
 
         const parsedBody = updateSiteBodySchema.safeParse(req.body);
         if (!parsedBody.success) {
             return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    fromError(parsedBody.error).toString()
-                )
+                createHttpError(HttpCode.BAD_REQUEST, fromError(parsedBody.error).toString())
             );
         }
 
         const { siteId } = parsedParams.data;
-        const { newtId, newtSecret } = parsedBody.data;
+        const { type, exitNodeId, pubKey, subnet, newtId, newtSecret } = parsedBody.data;
 
-        const secretHash = await hashPassword(newtSecret!);
-        const updatedSite = await db
-            .update(newts)
-            .set({
-                newtId,
-                secretHash
-            })
-            .where(eq(newts.siteId, siteId))
-            .returning();
+        let updatedSite = undefined;
 
-        if (updatedSite.length === 0) {
-            return next(
-                createHttpError(
-                    HttpCode.NOT_FOUND,
-                    `Site with ID ${siteId} not found`
-                )
-            );
+        if (type === "newt") {
+            if (!newtSecret) {
+                return next(
+                    createHttpError(HttpCode.BAD_REQUEST, "newtSecret is required for newt sites")
+                );
+            }
+
+            const secretHash = await hashPassword(newtSecret);
+
+            updatedSite = await db
+                .update(newts)
+                .set({
+                    newtId,
+                    secretHash,
+                })
+                .where(eq(newts.siteId, siteId))
+                .returning();
+
+            logger.info(`Regenerated Newt credentials for site ${siteId}`);
+
+        } else if (type === "wireguard") {
+            if (!pubKey) {
+                return next(
+                    createHttpError(HttpCode.BAD_REQUEST, "Public key is required for wireguard sites")
+                );
+            }
+
+            if (!exitNodeId) {
+                return next(
+                    createHttpError(
+                        HttpCode.BAD_REQUEST,
+                        "Exit node ID is required for wireguard sites"
+                    )
+                );
+            }
+
+            try {
+                updatedSite = await db.transaction(async (tx) => {
+                    await addPeer(exitNodeId, {
+                        publicKey: pubKey,
+                        allowedIps: subnet ? [subnet] : [],
+                    });
+                    const result = await tx
+                        .update(sites)
+                        .set({ pubKey })
+                        .where(eq(sites.siteId, siteId))
+                        .returning();
+
+                    return result;
+                });
+
+                logger.info(`Regenerated WireGuard credentials for site ${siteId}`);
+            } catch (err) {
+                logger.error(
+                    `Transaction failed while regenerating WireGuard secret for site ${siteId}`,
+                    err
+                );
+                return next(
+                    createHttpError(
+                        HttpCode.INTERNAL_SERVER_ERROR,
+                        "Failed to regenerate WireGuard credentials. Rolled back transaction."
+                    )
+                );
+            }
         }
 
         return response(res, {
-            data: updatedSite[0],
+            data: updatedSite,
             success: true,
             error: false,
             message: "Credentials regenerated successfully",
-            status: HttpCode.OK
+            status: HttpCode.OK,
         });
+
     } catch (error) {
-        logger.error(error);
+        logger.error("Unexpected error in reGenerateSiteSecret", error);
         return next(
-            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
+            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An unexpected error occurred")
         );
     }
 }