feat(api): add ACM certificates to the cloud explorer

Request public certificates (optionally exportable) or import your own, see
each domain's DNS validation records and what uses a certificate, download the
certificate and chain, export an exportable one with its encrypted key, and
revoke it. ListCertificates asks for every key type, since AWS otherwise
leaves EC certificates out.

packages/api/src/routes/clouds.test.ts

@@ -18,6 +18,7 @@ import {awsStorageSchema, azureStorageSchema, gcpStorageSchema} from '../cloud-s
 import {awsSesEmailSchema} from '../cloud-spi/emailSchema'
 import {awsUserPoolsSchema} from '../cloud-spi/userPoolsSchema'
 import {awsCdnSchema} from '../cloud-spi/cdnSchema'
+import {awsCertificatesSchema} from '../cloud-spi/certificatesSchema'
 import {awsMonitoringSchema} from '../cloud-spi/monitoringSchema'
 import {awsAppConfigSchema} from '../cloud-spi/appConfigSchema'
 import {awsEventBridgeSchema} from '../cloud-spi/eventbridgeSchema'
@@ -823,6 +824,34 @@ describe('cloud schema routes', () => {
         expect(calls).toEqual([['enabled', 'E123', false], ['invalidate', 'E123', ['/*']]])
     })
 
+    test('downloads, exports and revokes a certificate through the ACM adapter', async () => {
+        const calls: unknown[] = []
+        const app = appWithRoutes([mockAdapter('aws', {
+            service: 'certificates',
+            schema: awsCertificatesSchema,
+            getCertificatePem: async (id) => {
+                calls.push(['pem', id])
+                return {certificate: 'CERT', certificateChain: null}
+            },
+            exportCertificate: async (id, passphrase) => {
+                calls.push(['export', id, passphrase])
+                return {certificate: 'CERT', certificateChain: null, privateKey: 'KEY'}
+            },
+            revokeCertificate: async (id, reason) => {
+                calls.push(['revoke', id, reason])
+                return {id, name: 'a.test', cloud: 'aws', service: 'certificates', type: 'certificate', region: null, createdAt: null, status: 'REVOKED', metadata: {}}
+            },
+        })])
+        const json = (body: unknown) => ({method: 'POST', headers: {'content-type': 'application/json'}, body: JSON.stringify(body)})
+        const base = '/api/clouds/aws/services/certificates/resources/c1'
+
+        expect(await (await app.request(`${base}/pem`)).json()).toEqual({certificate: 'CERT', certificateChain: null})
+        expect((await (await app.request(`${base}/export`, json({passphrase: 'secret'}))).json()).privateKey).toBe('KEY')
+        const revoked = await app.request(`${base}/revoke`, json({}))
+        expect((await revoked.json()).status).toBe('REVOKED')
+        expect(calls).toEqual([['pem', 'c1'], ['export', 'c1', 'secret'], ['revoke', 'c1', 'UNSPECIFIED']])
+    })
+
     test('clears the SES mailbox through the email adapter', async () => {
         let cleared = false
         const app = appWithRoutes([mockAdapter('aws', {