kube CSR: preload UI fields

cmd/dkl-local-server/ws-clusters.go

@@ -2,6 +2,8 @@ package main
 
 import (
 	"bytes"
+	"crypto/x509"
+	"encoding/pem"
 	"errors"
 	"fmt"
 	"log"
@@ -355,3 +357,39 @@ func parseCertDuration(d string, now time.Time) (t time.Time, err error) {
 
 	return
 }
+
+type KubeCSRParseReq struct {
+	CSR string `json:"csr"`
+}
+
+type KubeCSRParseResp struct {
+	User  string `json:"user,omitempty"`
+	Group string `json:"group,omitempty"`
+}
+
+func wsParseKubeCSR(req *restful.Request, resp *restful.Response) {
+	var r KubeCSRParseReq
+	if err := req.ReadEntity(&r); err != nil {
+		wsError(resp, err)
+		return
+	}
+
+	block, _ := pem.Decode([]byte(r.CSR))
+	if block == nil || block.Type != "CERTIFICATE REQUEST" {
+		wsError(resp, fmt.Errorf("invalid CSR PEM"))
+		return
+	}
+
+	cr, err := x509.ParseCertificateRequest(block.Bytes)
+	if err != nil {
+		wsError(resp, fmt.Errorf("parse CSR: %w", err))
+		return
+	}
+
+	out := KubeCSRParseResp{User: cr.Subject.CommonName}
+	if len(cr.Subject.Organization) > 0 {
+		out.Group = cr.Subject.Organization[0]
+	}
+
+	resp.WriteAsJson(out)
+}

cmd/dkl-local-server/ws.go

@@ -42,7 +42,11 @@ func registerWS(rest *restful.Container) {
 				Param(ws.PathParameter("asset", "the requested asset")).
 				Doc("Fetch an asset via a download token")).
 			Route(ws.GET("/download-set").To(wsDownloadSet)).
-			Route(ws.GET("/download-set/{kind}/{name}/{asset}").To(wsDownloadSetAsset))
+			Route(ws.GET("/download-set/{kind}/{name}/{asset}").To(wsDownloadSetAsset)).
+			Route(ws.POST("/parse-kube-csr").To(wsParseKubeCSR).
+				Reads(KubeCSRParseReq{}).
+				Writes(KubeCSRParseResp{}).
+				Doc("Parse a Kubernetes CSR PEM and return the subject fields"))
 
 		rest.Add(ws)
 	}