66 lines
2.4 KiB
TypeScript
66 lines
2.4 KiB
TypeScript
import assert from "node:assert/strict"
|
||
import {
|
||
certificateRole,
|
||
isCaCertificate,
|
||
mapRosCertificateRow,
|
||
type RosCertificateRow,
|
||
} from "./certificate-parse.js"
|
||
|
||
// Реальные серты пользователя: MyCA (root) → vpn-server, client1, anakondra.
|
||
const myCa: RosCertificateRow = {
|
||
name: "MyCA",
|
||
"common-name": "MyCA",
|
||
"key-usage": "key-cert-sign,crl-sign",
|
||
ca: "",
|
||
flags: "KAT",
|
||
authority: "true",
|
||
}
|
||
const vpnServer: RosCertificateRow = {
|
||
name: "vpn-server",
|
||
"common-name": "vpn.example.com",
|
||
"key-usage": "digital-signature,key-encipherment,key-cert-sign,crl-sign,tls-server,tls-client",
|
||
ca: "MyCA",
|
||
flags: "KLAT",
|
||
}
|
||
const client1: RosCertificateRow = {
|
||
name: "client1",
|
||
"common-name": "client1",
|
||
"key-usage": "digital-signature,key-encipherment,key-cert-sign,crl-sign,tls-server,tls-client",
|
||
ca: "MyCA",
|
||
flags: "KLAT",
|
||
}
|
||
const anakondra: RosCertificateRow = { ...client1, name: "anakondra", "common-name": "anakondra" }
|
||
|
||
{
|
||
assert.ok(isCaCertificate(myCa))
|
||
// default key-usage содержит key-cert-sign, но ca заполнен → не CA
|
||
assert.ok(!isCaCertificate(vpnServer))
|
||
assert.ok(!isCaCertificate(client1))
|
||
}
|
||
|
||
{
|
||
const ctx = {
|
||
peerCertNames: ["vpn-server"],
|
||
identityCertNames: ["client1", "anakondra"],
|
||
}
|
||
assert.equal(certificateRole(myCa, ctx), "ca")
|
||
assert.equal(certificateRole(vpnServer, ctx), "server")
|
||
// reference-based важнее key-usage: у client1 в key-usage есть tls-server, но он client
|
||
assert.equal(certificateRole(client1, ctx), "client")
|
||
assert.equal(certificateRole(anakondra, ctx), "client")
|
||
// без reference-контекста: подпись локальным CA делает серт клиентским, несмотря на tls-server в usage
|
||
assert.equal(certificateRole(client1), "client")
|
||
assert.equal(certificateRole(anakondra), "client")
|
||
// без контекста — по key-usage (default содержит оба, поэтому server)
|
||
assert.equal(certificateRole({ name: "x", "key-usage": "tls-client" }), "client")
|
||
assert.equal(certificateRole({ name: "y", "key-usage": "digital-signature" }), "other")
|
||
}
|
||
|
||
{
|
||
const dto = mapRosCertificateRow(1, "mt", client1)
|
||
assert.equal(dto?.signedByCertName, "MyCA")
|
||
assert.equal(mapRosCertificateRow(1, "mt", myCa)?.signedByCertName, undefined)
|
||
}
|
||
|
||
console.log("certificate-parse.test.ts: ok")
|