feat(authz): work out the access level automatically, retire opext (#214)

CreateOperatorCredentialRequest already builds the extfile section a CA
operator needs from internal/authz's codec (MarshalLevelExtension via
operatorca.ExtfileSection), and first run's RegisterOperatorCA preview does
the same for the first admin certificate. cmd/opext's manual byte-crunching
step was dead weight left over from before that flow existed, so it's gone,
along with the docs that told readers to run it and copy bytes out of a
table.

A handful of test fixtures still hand-rolled the extension value with
asn1.Marshal(level.Token()) instead of calling authz.MarshalLevelValue; they
now point at the same codec as everything else.

Signed-off-by: Bugs5382 <12115015+Bugs5382@users.noreply.github.com>
Co-authored-by: Bugs5382 <12115015+Bugs5382@users.noreply.github.com>

Author: Bugs5382

cmd/opext/main.go

@@ -127,40 +127,44 @@ operator CA (as above) rather than reusing the fleet intermediate, so the set of
 certs that can open a TLS session to the management plane stays exactly the set
 you minted for operators.
 
-### The level extension in OpenSSL form
+### The level extension comes from the manager, not by hand
 
-`go run ./cmd/opext` prints the level extension as a byte sequence
-(`[19, 5, 97, 100, 109, 105, 110]`). An OpenSSL operator CA needs the same DER
-in `-extfile` form. These are identical bytes — `0x13` is ASN.1
-`PrintableString`, `0x05` its length:
+Every operator certificate carries its access level in the extension
+`1.3.6.1.4.1.59999.1.1`. Nobody hand-builds that DER or copies it from a table —
+the manager derives it from the one codec (`internal/authz.MarshalLevelValue`)
+and hands you a ready-to-use OpenSSL section:
 
-```ini
-# op-admin.ext
-extendedKeyUsage = clientAuth
-keyUsage = critical, digitalSignature
-basicConstraints = critical, CA:FALSE
-1.3.6.1.4.1.59999.1.1 = DER:13:05:61:64:6D:69:6E
-```
+- **The very first admin certificate**, before any admin exists to call the
+  API, comes from first run: `RegisterOperatorCA`'s preview response includes
+  `admin_extfile`, the `[ op_admin ]` section below. See
+  [first-run.md](first-run.md).
+- **Every credential after that** comes from `CreateOperatorCredentialRequest`,
+  whose response includes `extfile_section` for the level requested (`viewer`,
+  `operator` or `admin`) and the `openssl ca` command that signs it with that
+  section. See [operator-credentials.md](operator-credentials.md).
 
-`basicConstraints` matters: without it `openssl x509 -req -extfile` emits a v3
-certificate carrying **no** basic constraints extension at all, which is not what the
-cryptos profile path produces for a leaf and not what you want an operator credential to
-look like. Pin it to `CA:FALSE` explicitly.
+Save the section the API gave you, for example as `op-admin.ext`:
 
-| Level | DER | `opext` bytes |
-| --- | --- | --- |
-| `viewer` | `DER:13:06:76:69:65:77:65:72` | `[19, 6, 118, 105, 101, 119, 101, 114]` |
-| `operator` | `DER:13:08:6F:70:65:72:61:74:6F:72` | `[19, 8, 111, 112, 101, 114, 97, 116, 111, 114]` |
-| `admin` | `DER:13:05:61:64:6D:69:6E` | `[19, 5, 97, 100, 109, 105, 110]` |
+```ini
+# op-admin.ext (from admin_extfile / extfile_section)
+[ op_admin ]
+basicConstraints       = critical, CA:FALSE
+keyUsage               = critical, digitalSignature
+extendedKeyUsage       = clientAuth
+subjectKeyIdentifier   = hash
+authorityKeyIdentifier = keyid
+1.3.6.1.4.1.59999.1.1  = DER:13:05:61:64:6D:69:6E
+```
 
-Mint and verify an operator certificate:
+Then mint and verify the operator certificate:
 
 ```sh
 openssl ecparam -name secp384r1 -genkey -noout -out operator-admin.key
 chmod 600 operator-admin.key
 openssl req -new -key operator-admin.key -subj "/CN=you@acme.example" -out operator-admin.csr
 openssl x509 -req -in operator-admin.csr -CA operator-ca.crt -CAkey operator-ca.key \
-  -CAcreateserial -days 365 -sha384 -extfile op-admin.ext -out operator-admin.crt
+  -CAcreateserial -days 365 -sha384 -extfile op-admin.ext -extensions op_admin \
+  -out operator-admin.crt
 
 openssl x509 -in operator-admin.crt -text -noout | grep -A2 '59999.1.1'   # ..admin
 openssl verify -CAfile operator-ca.crt operator-admin.crt                 # OK

cmd/opext/main_test.go

@@ -205,16 +205,12 @@ people.
 
 An operator certificate carries its access level in the extension
 `1.3.6.1.4.1.59999.1.1` (`authz.AccessLevelOID`): the DER of an ASN.1
-PrintableString of `viewer`, `operator` or `admin`.
-
-| Level | OpenSSL `DER:` value | `opext` bytes |
-| --- | --- | --- |
-| `viewer` | `DER:13:06:76:69:65:77:65:72` | `[19, 6, 118, 105, 101, 119, 101, 114]` |
-| `operator` | `DER:13:08:6F:70:65:72:61:74:6F:72` | `[19, 8, 111, 112, 101, 114, 97, 116, 111, 114]` |
-| `admin` | `DER:13:05:61:64:6D:69:6E` | `[19, 5, 97, 100, 109, 105, 110]` |
-
-`go run ./cmd/opext -level <level>` prints the byte form from the same encoding
-the manager reads.
+PrintableString of `viewer`, `operator` or `admin`. `internal/authz.MarshalLevelValue`
+is the single place that encodes it. `CreateOperatorCredentialRequest`'s
+`extfile_section` above, and first run's `admin_extfile`
+([first-run.md](first-run.md)), both come from that same codec
+(`internal/operatorca.ExtfileSection`), so nothing hand-builds the DER bytes or
+copies them from a table.
 
 > [!NOTE]
 > `1.3.6.1.4.1.59999.1.1` is a placeholder arc. An IANA Private Enterprise

docs/deploying-standalone.md

@@ -84,10 +84,9 @@ func MarshalLevelValue(l Level) ([]byte, error) {
 
 // MarshalLevelExtension returns the dotted OID and DER value of the
 // access-level extension for the given level token. It is the single encoding
-// used by both cmd/opext (which prints the value for a profile's
-// extra_extensions) and the operator-CA profile setup that stamps an
-// operator-<level> profile with the level extension. It errors if level is not
-// one of viewer|operator|admin.
+// used by the operator-CA profile setup (internal/operatorca.ExtfileSection)
+// that builds the op_<level> extfile section a CA operator signs an operator
+// credential with. It errors if level is not one of viewer|operator|admin.
 func MarshalLevelExtension(level string) (oid string, der []byte, err error) {
 	l, err := LevelFromToken(level)
 	if err != nil {

docs/operator-credentials.md

@@ -45,7 +45,7 @@ import (
 // self-signed operator certificate at level with the given serial.
 func certCtx(t *testing.T, serial int64, level authz.Level) context.Context {
 	t.Helper()
-	value, _ := asn1.Marshal(level.Token())
+	value, _ := authz.MarshalLevelValue(level)
 	key, _ := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
 	tmpl := &x509.Certificate{
 		SerialNumber:    big.NewInt(serial),

internal/authz/level.go

@@ -72,7 +72,7 @@ func (ca testCA) pool() *x509.CertPool {
 // notBefore to notAfter.
 func (ca testCA) operatorCert(t *testing.T, serial int64, level authz.Level, notBefore, notAfter time.Time) *x509.Certificate {
 	t.Helper()
-	value, err := asn1.Marshal(level.Token())
+	value, err := authz.MarshalLevelValue(level)
 	if err != nil {
 		t.Fatal(err)
 	}

internal/fleet/mcpkeys_test.go

@@ -231,7 +231,7 @@ func (noneRevoked) CheckMCP(string, string) error { return nil }
 // key mints a key for a fresh operator certificate at level with ceiling.
 func (h *harness) key(level authz.Level, ceiling string) string {
 	h.t.Helper()
-	value, _ := asn1.Marshal(level.Token())
+	value, _ := authz.MarshalLevelValue(level)
 	key, _ := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
 	serial, _ := rand.Int(rand.Reader, big.NewInt(1<<62))
 	tmpl := &x509.Certificate{

internal/mcpauth/testcerts_test.go

@@ -76,7 +76,7 @@ func newFixture(t *testing.T) *fixture {
 }
 
 func (f *fixture) operatorCert(serial int64, level authz.Level) *x509.Certificate {
-	value, _ := asn1.Marshal(level.Token())
+	value, _ := authz.MarshalLevelValue(level)
 	key, _ := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
 	tmpl := &x509.Certificate{
 		SerialNumber: big.NewInt(serial), Subject: pkix.Name{CommonName: "operator@example.org"},