fix(ipsec): экспортировать сертификат только по прямой привязке

backend/src/routes/ipsec-mutation.test.ts

@@ -6,9 +6,9 @@ import { MikrotikClient, MikrotikError } from "../services/mikrotik.js"
 import { fetchIpsecState } from "../services/ipsec-live.js"
 const server = { id: 1, name: "test", host: "192.0.2.1", enabled: true } as Parameters<typeof fetchIpsecState>[0]
 const original = MikrotikClient.fromServer
-let writes = 0, records = 0, fault = "", certificateFixture = false, removedCertificates = 0
+let writes = 0, records = 0, fault = "", certificateFixture = false, removedCertificates = 0, exports = 0, exportedName = ""
 const identities: Record<string,string>[] = [{ ".id": "*I", peer: "ike", "auth-method": "pre-shared-key", "remote-id": "key-id:alice", "mode-config": "mc-ipsec-alice", comment: "MikrotikManager:ipsec user=Alice" }, { ".id": "*OTHER", peer: "ike", "auth-method": "pre-shared-key", "remote-id": "key-id:other", "mode-config": "mc-ipsec-other", comment: "MikrotikManager:ipsec user=Other" }]
-MikrotikClient.fromServer = () => ({ get: async (p: string) => certificateFixture && p === "/certificate" ? [{ ".id": "*CERT", name: "ipsec-user-shared", "common-name": "shared", "key-usage": "tls-client" }] : p === "/ip/ipsec/peer" ? [{ ".id": "*P", name: "ike", "exchange-mode": "ike2" }] : p === "/ip/ipsec/identity" ? identities : p === "/ip/ipsec/mode-config" ? [{ ".id": "*MC", name: "mc-ipsec-alice", address: "198.18.81.250" }, { ".id": "*OTHERMC", name: "mc-ipsec-other", address: "198.18.81.249" }] : [], removeCertificate: async () => { writes++; removedCertificates++ }, put: async () => { writes++ }, post: async () => { writes++ }, delete: async () => { writes++ }, patch: async (path: string, body: Record<string,string>) => { writes++; if (fault === "partial" && writes === 2) throw new MikrotikError(403, path, "rejected"); Object.assign(identities.find(i => path.endsWith(i[".id"]))!, body); if (fault === "lost-ack") throw Error("socket closed after application") } }) as unknown as MikrotikClient
+MikrotikClient.fromServer = () => ({ get: async (p: string) => certificateFixture && p === "/certificate" ? [{ ".id": "*CERT", name: "ipsec-user-shared", "common-name": "shared", "key-usage": "tls-client" }] : p === "/ip/ipsec/peer" ? [{ ".id": "*P", name: "ike", "exchange-mode": "ike2" }] : p === "/ip/ipsec/identity" ? identities : p === "/ip/ipsec/mode-config" ? [{ ".id": "*MC", name: "mc-ipsec-alice", address: "198.18.81.250" }, { ".id": "*OTHERMC", name: "mc-ipsec-other", address: "198.18.81.249" }] : [], getCertificates: async () => certificateFixture ? [{name:"ipsec-user-shared"}] : [], exportCertificatePkcs12: async (args: {name:string}) => {exports++;exportedName=args.name;return {fileName:args.name+".p12",content:Buffer.from("fixture-only-archive"),passphrase:"fixture-only-pass"}}, removeCertificate: async () => { writes++; removedCertificates++ }, put: async () => { writes++ }, post: async () => { writes++ }, delete: async () => { writes++ }, patch: async (path: string, body: Record<string,string>) => { writes++; if (fault === "partial" && writes === 2) throw new MikrotikError(403, path, "rejected"); Object.assign(identities.find(i => path.endsWith(i[".id"]))!, body); if (fault === "lost-ack") throw Error("socket closed after application") } }) as unknown as MikrotikClient
 const app = Fastify(); app.setValidatorCompiler(validatorCompiler); app.setSerializerCompiler(serializerCompiler)
 await app.register(createIpsecRoutes({ findServer: async () => server, recordRevision: async () => { records++; return {created:false,revision:{} as never} } }), { prefix: "/api" })
 const patch = (payload: Record<string, unknown>) => app.inject({ method: "PATCH", url: "/api/ipsec/users/1/identity:*I", payload })
@@ -22,12 +22,18 @@ writes=records=0; fault=""; r=await patch({remoteId:"fresh"}); assert.equal(r.st
 
 // A same-named certificate is a separate object, not a binding inferred from a PSK label.
 certificateFixture=true;identities.splice(0,identities.length,{".id":"*UNBOUND",peer:"ike","auth-method":"pre-shared-key","remote-id":"key-id:unbound",comment:"MikrotikManager:ipsec user=shared"});
+exports=0;let exported=await app.inject({method:"POST",url:"/api/ipsec/users/1/identity:*UNBOUND/cert",payload:{passphrase:"fixture-pass"}});assert.equal(exported.statusCode,409);assert.equal(exports,0);assert.equal(exported.json().contentB64,undefined);
 writes=records=removedCertificates=0;
 let deletion=await app.inject({method:"DELETE",url:"/api/ipsec/users/1/identity:*UNBOUND"});assert.equal(deletion.statusCode,200);assert.equal(writes,1);assert.equal(removedCertificates,0);assert.equal(records,1);
+
+
 // Explicit certificate binding still permits deletion when no other references exist.
 identities.splice(0,identities.length,{".id":"*BOUND",peer:"ike","auth-method":"digital-signature","remote-certificate":"ipsec-user-shared",comment:"MikrotikManager:ipsec user=shared"});
+identities[0]!.comment="MikrotikManager:ipsec user=Renamed label";exports=0;exported=await app.inject({method:"POST",url:"/api/ipsec/users/1/identity:*BOUND/cert",payload:{passphrase:"fixture-pass"}});assert.equal(exported.statusCode,200);assert.equal(exports,1);assert.equal(exportedName,"ipsec-user-shared");assert.equal(exported.json().user,"Renamed label");
 writes=records=removedCertificates=0;
 deletion=await app.inject({method:"DELETE",url:"/api/ipsec/users/1/identity:*BOUND"});assert.equal(deletion.statusCode,200);assert.equal(writes,2);assert.equal(removedCertificates,1);assert.equal(records,1);
+
+
 certificateFixture=true;identities.splice(0,identities.length,...["*FIRST","*SECOND"].map((id,n)=>({".id":id,peer:"ike","auth-method":"digital-signature","remote-certificate":"ipsec-user-shared",comment:"MikrotikManager:ipsec user=Shared"+n})));
 for(const method of ["PATCH","DELETE"] as const){writes=records=0;const r=await app.inject({method,url:"/api/ipsec/users/1/cert:*CERT",...(method==="PATCH"?{payload:{name:"Wrong"}}:{})});assert.equal(r.statusCode,409);assert.equal(writes,0);assert.equal(records,0)}
 writes=records=0;r=await app.inject({method:"DELETE",url:"/api/ipsec/users/1/identity:*FIRST"});assert.equal(r.statusCode,409);assert.equal(writes,0);assert.equal(records,0);

backend/src/routes/ipsec.ts

@@ -689,7 +689,10 @@ export function createIpsecRoutes(dependencies = ipsecDefaults): FastifyPluginAs
       if (!identity) return reply.status(404).send({ error: "Клиент не найден" })
       const userName = parseIpsecUserComment(identity.comment) ?? ""
       if (!userName) return reply.status(400).send({ error: "Не managed-клиент" })
-      const certName = identity["remote-certificate"]?.trim() || clientCertName(userName)
+      const certName = identity["remote-certificate"]?.trim()
+      if (!certName || identity["auth-method"]?.trim().toLowerCase() === "pre-shared-key") {
+        return reply.status(409).send({ error: "У выбранного клиента нет привязанного клиентского сертификата. Для отдельного сертификата используйте экспорт по его имени" })
+      }
       if (!(await findCertificate(client, certName))) {
         return reply.status(404).send({ error: `Сертификат ${certName} не найден на роутере` })
       }