mirror of
https://github.com/awatertrevi/infisical.git
synced 2026-09-22 13:39:35 +00:00
Removed test specs used for development
This commit is contained in:
Carlos Monastyrski
@@ -1,428 +0,0 @@
|
||||
import { seedData1 } from "@app/db/seed-data";
|
||||
|
||||
describe("Certificate EST Router", () => {
|
||||
let projectId: string;
|
||||
let certificateAuthorityId: string;
|
||||
let templateId: string;
|
||||
let profileId: string;
|
||||
let estPassphrase: string;
|
||||
|
||||
beforeAll(async () => {
|
||||
projectId = seedData1.project.id;
|
||||
estPassphrase = "test-est-passphrase";
|
||||
|
||||
// Create a test certificate authority first
|
||||
const caRes = await testServer.inject({
|
||||
method: "POST",
|
||||
url: "/api/v1/pki/ca",
|
||||
headers: {
|
||||
authorization: `Bearer ${jwtAuthToken}`
|
||||
},
|
||||
body: {
|
||||
projectSlug: seedData1.project.slug,
|
||||
type: "root",
|
||||
friendlyName: "Test Root CA for EST",
|
||||
organization: "Test Org",
|
||||
ou: "Test OU",
|
||||
country: "US",
|
||||
province: "CA",
|
||||
locality: "San Francisco",
|
||||
commonName: "Test Root CA for EST",
|
||||
ttl: "8760h"
|
||||
}
|
||||
});
|
||||
expect(caRes.statusCode).toBe(200);
|
||||
const caPayload = JSON.parse(caRes.payload);
|
||||
certificateAuthorityId = caPayload.certificateAuthority.id;
|
||||
|
||||
// Create a test certificate template v2
|
||||
const templateRes = await testServer.inject({
|
||||
method: "POST",
|
||||
url: "/api/v2/certificate-templates",
|
||||
headers: {
|
||||
authorization: `Bearer ${jwtAuthToken}`
|
||||
},
|
||||
body: {
|
||||
projectId,
|
||||
certificateAuthorityId,
|
||||
name: "Test Template for EST",
|
||||
policy: {
|
||||
allowedDomains: ["est.example.com", "*.est.example.com"],
|
||||
allowWildcards: true,
|
||||
maxTtl: "8760h"
|
||||
}
|
||||
}
|
||||
});
|
||||
expect(templateRes.statusCode).toBe(200);
|
||||
const templatePayload = JSON.parse(templateRes.payload);
|
||||
templateId = templatePayload.certificateTemplate.id;
|
||||
|
||||
// Create a test certificate profile with EST enrollment
|
||||
const profileRes = await testServer.inject({
|
||||
method: "POST",
|
||||
url: "/api/v1/certificate-profiles",
|
||||
headers: {
|
||||
authorization: `Bearer ${jwtAuthToken}`
|
||||
},
|
||||
body: {
|
||||
projectId,
|
||||
certificateAuthorityId,
|
||||
certificateTemplateId: templateId,
|
||||
name: "Test EST Profile",
|
||||
slug: "test-est-profile",
|
||||
enrollmentMethod: "est",
|
||||
enrollmentConfig: {
|
||||
estConfig: {
|
||||
passphrase: estPassphrase,
|
||||
disableBootstrapCaValidation: false,
|
||||
encryptedCaChain: "test-encrypted-ca-chain"
|
||||
}
|
||||
}
|
||||
}
|
||||
});
|
||||
expect(profileRes.statusCode).toBe(200);
|
||||
const profilePayload = JSON.parse(profileRes.payload);
|
||||
profileId = profilePayload.certificateProfile.id;
|
||||
});
|
||||
|
||||
describe("GET /:identifier/cacerts", () => {
|
||||
test("Should get CA certificates using profileId (no authentication required)", async () => {
|
||||
const res = await testServer.inject({
|
||||
method: "GET",
|
||||
url: `/api/est/${profileId}/cacerts`
|
||||
});
|
||||
|
||||
expect(res.statusCode).toBe(200);
|
||||
expect(res.headers["content-type"]).toContain("application/pkcs7-mime");
|
||||
expect(res.headers["content-transfer-encoding"]).toBe("base64");
|
||||
expect(typeof res.payload).toBe("string");
|
||||
});
|
||||
|
||||
test("Should get CA certificates using legacy templateId (backward compatibility)", async () => {
|
||||
// First enable EST on the legacy template
|
||||
const enableEstRes = await testServer.inject({
|
||||
method: "PATCH",
|
||||
url: `/api/v1/pki/templates/${templateId}`,
|
||||
headers: {
|
||||
authorization: `Bearer ${jwtAuthToken}`
|
||||
},
|
||||
body: {
|
||||
estConfig: {
|
||||
isEnabled: true,
|
||||
passphrase: estPassphrase
|
||||
}
|
||||
}
|
||||
});
|
||||
expect(enableEstRes.statusCode).toBe(200);
|
||||
|
||||
const res = await testServer.inject({
|
||||
method: "GET",
|
||||
url: `/api/est/${templateId}/cacerts`
|
||||
});
|
||||
|
||||
expect(res.statusCode).toBe(200);
|
||||
expect(res.headers["content-type"]).toContain("application/pkcs7-mime");
|
||||
});
|
||||
|
||||
test("Should return 404 for non-existent identifier", async () => {
|
||||
const res = await testServer.inject({
|
||||
method: "GET",
|
||||
url: "/api/est/non-existent-id/cacerts"
|
||||
});
|
||||
|
||||
expect(res.statusCode).toBe(404);
|
||||
});
|
||||
});
|
||||
|
||||
describe("Authentication for EST endpoints", () => {
|
||||
test("Should require authentication for simpleenroll", async () => {
|
||||
const res = await testServer.inject({
|
||||
method: "POST",
|
||||
url: `/api/est/${profileId}/simpleenroll`,
|
||||
body: "test-csr"
|
||||
});
|
||||
|
||||
expect(res.statusCode).toBe(401);
|
||||
expect(res.headers["www-authenticate"]).toBe('Basic realm="infisical"');
|
||||
});
|
||||
|
||||
test("Should require authentication for simplereenroll", async () => {
|
||||
const res = await testServer.inject({
|
||||
method: "POST",
|
||||
url: `/api/est/${profileId}/simplereenroll`,
|
||||
body: "test-csr"
|
||||
});
|
||||
|
||||
expect(res.statusCode).toBe(401);
|
||||
});
|
||||
|
||||
test("Should reject invalid credentials", async () => {
|
||||
const invalidAuth = Buffer.from("user:wrongpassword").toString("base64");
|
||||
|
||||
const res = await testServer.inject({
|
||||
method: "POST",
|
||||
url: `/api/est/${profileId}/simpleenroll`,
|
||||
headers: {
|
||||
authorization: `Basic ${invalidAuth}`,
|
||||
"content-type": "application/pkcs10"
|
||||
},
|
||||
body: "test-csr"
|
||||
});
|
||||
|
||||
expect(res.statusCode).toBe(401);
|
||||
});
|
||||
|
||||
test("Should accept valid credentials", async () => {
|
||||
const validAuth = Buffer.from(`user:${estPassphrase}`).toString("base64");
|
||||
|
||||
const res = await testServer.inject({
|
||||
method: "POST",
|
||||
url: `/api/est/${profileId}/simpleenroll`,
|
||||
headers: {
|
||||
authorization: `Basic ${validAuth}`,
|
||||
"content-type": "application/pkcs10"
|
||||
},
|
||||
body: "test-csr"
|
||||
});
|
||||
|
||||
expect(res.statusCode).not.toBe(401);
|
||||
});
|
||||
});
|
||||
|
||||
describe("POST /:identifier/simpleenroll", () => {
|
||||
let validAuth: string;
|
||||
let testCSR: string;
|
||||
|
||||
beforeAll(() => {
|
||||
validAuth = Buffer.from(`user:${estPassphrase}`).toString("base64");
|
||||
// Mock CSR for testing
|
||||
testCSR = `-----BEGIN CERTIFICATE REQUEST-----
|
||||
MIICWjCCAUICAQAwFTETMBEGA1UEAwwKdGVzdC5jb20uY2ExXDANBgkqhkiG9w0B
|
||||
AQEFAAOBiQAwgYUCgYEAyKdVQNK5Wf7V8qU2tU3hV7g4+OJ+Xz8TzL1Q2u8cQ9v
|
||||
...mock CSR content...
|
||||
yK5ZqN8U3QR7yB+X9vG1eI+dA==
|
||||
-----END CERTIFICATE REQUEST-----`;
|
||||
});
|
||||
|
||||
test("Should process enrollment request with profileId", async () => {
|
||||
const res = await testServer.inject({
|
||||
method: "POST",
|
||||
url: `/api/est/${profileId}/simpleenroll`,
|
||||
headers: {
|
||||
authorization: `Basic ${validAuth}`,
|
||||
"content-type": "application/pkcs10"
|
||||
},
|
||||
body: testCSR
|
||||
});
|
||||
|
||||
expect([200, 400]).toContain(res.statusCode);
|
||||
|
||||
if (res.statusCode === 200) {
|
||||
expect(res.headers["content-type"]).toContain("application/pkcs7-mime");
|
||||
expect(res.headers["content-transfer-encoding"]).toBe("base64");
|
||||
}
|
||||
});
|
||||
|
||||
test("Should process enrollment request with legacy templateId", async () => {
|
||||
const res = await testServer.inject({
|
||||
method: "POST",
|
||||
url: `/api/est/${templateId}/simpleenroll`,
|
||||
headers: {
|
||||
authorization: `Basic ${validAuth}`,
|
||||
"content-type": "application/pkcs10"
|
||||
},
|
||||
body: testCSR
|
||||
});
|
||||
|
||||
expect([200, 400]).toContain(res.statusCode);
|
||||
});
|
||||
|
||||
test("Should handle PEM format CSR", async () => {
|
||||
const res = await testServer.inject({
|
||||
method: "POST",
|
||||
url: `/api/est/${profileId}/simpleenroll`,
|
||||
headers: {
|
||||
authorization: `Basic ${validAuth}`,
|
||||
"content-type": "application/pkcs10"
|
||||
},
|
||||
body: testCSR
|
||||
});
|
||||
|
||||
expect([200, 400]).toContain(res.statusCode);
|
||||
});
|
||||
|
||||
test("Should handle base64 format CSR", async () => {
|
||||
const base64CSR = testCSR
|
||||
.replace(/-----BEGIN CERTIFICATE REQUEST-----/, "")
|
||||
.replace(/-----END CERTIFICATE REQUEST-----/, "")
|
||||
.replace(/\n/g, "");
|
||||
|
||||
const res = await testServer.inject({
|
||||
method: "POST",
|
||||
url: `/api/est/${profileId}/simpleenroll`,
|
||||
headers: {
|
||||
authorization: `Basic ${validAuth}`,
|
||||
"content-type": "application/pkcs10"
|
||||
},
|
||||
body: base64CSR
|
||||
});
|
||||
|
||||
expect([200, 400]).toContain(res.statusCode);
|
||||
});
|
||||
|
||||
test("Should fail with empty CSR", async () => {
|
||||
const res = await testServer.inject({
|
||||
method: "POST",
|
||||
url: `/api/est/${profileId}/simpleenroll`,
|
||||
headers: {
|
||||
authorization: `Basic ${validAuth}`,
|
||||
"content-type": "application/pkcs10"
|
||||
},
|
||||
body: ""
|
||||
});
|
||||
|
||||
expect(res.statusCode).toBe(400);
|
||||
});
|
||||
});
|
||||
|
||||
describe("POST /:identifier/simplereenroll", () => {
|
||||
let validAuth: string;
|
||||
let testCSR: string;
|
||||
|
||||
beforeAll(() => {
|
||||
validAuth = Buffer.from(`user:${estPassphrase}`).toString("base64");
|
||||
testCSR = `-----BEGIN CERTIFICATE REQUEST-----
|
||||
MIICWjCCAUICAQAwFTETMBEGA1UEAwwKdGVzdC5jb20uY2ExXDANBgkqhkiG9w0B
|
||||
AQEFAAOBiQAwgYUCgYEAyKdVQNK5Wf7V8qU2tU3hV7g4+OJ+Xz8TzL1Q2u8cQ9v
|
||||
...mock CSR content...
|
||||
yK5ZqN8U3QR7yB+X9vG1eI+dA==
|
||||
-----END CERTIFICATE REQUEST-----`;
|
||||
});
|
||||
|
||||
test("Should process re-enrollment request with profileId", async () => {
|
||||
const res = await testServer.inject({
|
||||
method: "POST",
|
||||
url: `/api/est/${profileId}/simplereenroll`,
|
||||
headers: {
|
||||
authorization: `Basic ${validAuth}`,
|
||||
"content-type": "application/pkcs10"
|
||||
},
|
||||
body: testCSR
|
||||
});
|
||||
|
||||
expect([200, 400]).toContain(res.statusCode);
|
||||
|
||||
if (res.statusCode === 200) {
|
||||
expect(res.headers["content-type"]).toContain("application/pkcs7-mime");
|
||||
expect(res.headers["content-transfer-encoding"]).toBe("base64");
|
||||
}
|
||||
});
|
||||
|
||||
test("Should process re-enrollment request with legacy templateId", async () => {
|
||||
const res = await testServer.inject({
|
||||
method: "POST",
|
||||
url: `/api/est/${templateId}/simplereenroll`,
|
||||
headers: {
|
||||
authorization: `Basic ${validAuth}`,
|
||||
"content-type": "application/pkcs10"
|
||||
},
|
||||
body: testCSR
|
||||
});
|
||||
|
||||
expect([200, 400]).toContain(res.statusCode);
|
||||
});
|
||||
});
|
||||
|
||||
describe("EST Configuration Validation", () => {
|
||||
test("Should fail when EST is disabled on profile", async () => {
|
||||
// Create a profile with EST disabled
|
||||
const disabledProfileRes = await testServer.inject({
|
||||
method: "POST",
|
||||
url: "/api/v1/certificate-profiles",
|
||||
headers: {
|
||||
authorization: `Bearer ${jwtAuthToken}`
|
||||
},
|
||||
body: {
|
||||
projectId,
|
||||
certificateAuthorityId,
|
||||
certificateTemplateId: templateId,
|
||||
name: "Disabled EST Profile",
|
||||
slug: "disabled-est-profile",
|
||||
enrollmentMethod: "api" // Not EST
|
||||
}
|
||||
});
|
||||
expect(disabledProfileRes.statusCode).toBe(200);
|
||||
const disabledProfile = JSON.parse(disabledProfileRes.payload);
|
||||
|
||||
const validAuth = Buffer.from(`user:${estPassphrase}`).toString("base64");
|
||||
|
||||
const res = await testServer.inject({
|
||||
method: "POST",
|
||||
url: `/api/est/${disabledProfile.certificateProfile.id}/simpleenroll`,
|
||||
headers: {
|
||||
authorization: `Basic ${validAuth}`,
|
||||
"content-type": "application/pkcs10"
|
||||
},
|
||||
body: "test-csr"
|
||||
});
|
||||
|
||||
expect(res.statusCode).toBe(400);
|
||||
});
|
||||
|
||||
test("Should handle missing authorization header gracefully", async () => {
|
||||
const res = await testServer.inject({
|
||||
method: "POST",
|
||||
url: `/api/est/${profileId}/simpleenroll`,
|
||||
body: "test-csr"
|
||||
});
|
||||
|
||||
expect(res.statusCode).toBe(401);
|
||||
expect(res.headers["www-authenticate"]).toBeDefined();
|
||||
});
|
||||
});
|
||||
|
||||
describe("Content Type Handling", () => {
|
||||
test("Should handle different content types for CSR", async () => {
|
||||
const validAuth = Buffer.from(`user:${estPassphrase}`).toString("base64");
|
||||
|
||||
const res = await testServer.inject({
|
||||
method: "POST",
|
||||
url: `/api/est/${profileId}/simpleenroll`,
|
||||
headers: {
|
||||
authorization: `Basic ${validAuth}`,
|
||||
"content-type": "application/pkcs10"
|
||||
},
|
||||
body: "test-csr-content"
|
||||
});
|
||||
|
||||
// Should not fail due to content type
|
||||
expect(res.statusCode).not.toBe(415);
|
||||
});
|
||||
});
|
||||
|
||||
describe("Profile vs Template Identifier Detection", () => {
|
||||
test("Should correctly identify UUID as profileId", async () => {
|
||||
const isUUIDPattern = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
|
||||
expect(isUUIDPattern.test(profileId)).toBe(true);
|
||||
|
||||
const res = await testServer.inject({
|
||||
method: "GET",
|
||||
url: `/api/est/${profileId}/cacerts`
|
||||
});
|
||||
|
||||
expect(res.statusCode).toBe(200);
|
||||
});
|
||||
|
||||
test("Should correctly identify non-UUID as legacy templateId", async () => {
|
||||
const isUUIDPattern = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
|
||||
expect(isUUIDPattern.test(templateId)).toBe(false);
|
||||
|
||||
const res = await testServer.inject({
|
||||
method: "GET",
|
||||
url: `/api/est/${templateId}/cacerts`
|
||||
});
|
||||
|
||||
expect(res.statusCode).toBe(200);
|
||||
});
|
||||
});
|
||||
});
|
||||
@@ -1,391 +0,0 @@
|
||||
import { seedData1 } from "@app/db/seed-data";
|
||||
|
||||
describe("Certificate Profiles Router", () => {
|
||||
let projectId: string;
|
||||
let certificateAuthorityId: string;
|
||||
let templateId: string;
|
||||
let profileId: string;
|
||||
|
||||
beforeAll(async () => {
|
||||
projectId = seedData1.project.id;
|
||||
|
||||
// Create a test certificate authority first
|
||||
const caRes = await testServer.inject({
|
||||
method: "POST",
|
||||
url: "/api/v1/pki/ca",
|
||||
headers: {
|
||||
authorization: `Bearer ${jwtAuthToken}`
|
||||
},
|
||||
body: {
|
||||
projectSlug: seedData1.project.slug,
|
||||
type: "root",
|
||||
friendlyName: "Test Root CA",
|
||||
organization: "Test Org",
|
||||
ou: "Test OU",
|
||||
country: "US",
|
||||
province: "CA",
|
||||
locality: "San Francisco",
|
||||
commonName: "Test Root CA",
|
||||
ttl: "8760h"
|
||||
}
|
||||
});
|
||||
expect(caRes.statusCode).toBe(200);
|
||||
const caPayload = JSON.parse(caRes.payload);
|
||||
certificateAuthorityId = caPayload.certificateAuthority.id;
|
||||
|
||||
// Create a test certificate template v2
|
||||
const templateRes = await testServer.inject({
|
||||
method: "POST",
|
||||
url: "/api/v2/certificate-templates",
|
||||
headers: {
|
||||
authorization: `Bearer ${jwtAuthToken}`
|
||||
},
|
||||
body: {
|
||||
projectId,
|
||||
certificateAuthorityId,
|
||||
name: "Test Template for Profile",
|
||||
policy: {
|
||||
allowedDomains: ["example.com"],
|
||||
maxTtl: "8760h"
|
||||
}
|
||||
}
|
||||
});
|
||||
expect(templateRes.statusCode).toBe(200);
|
||||
const templatePayload = JSON.parse(templateRes.payload);
|
||||
templateId = templatePayload.certificateTemplate.id;
|
||||
});
|
||||
|
||||
describe("POST /v1/certificate-profiles", () => {
|
||||
test("Should create a certificate profile", async () => {
|
||||
const res = await testServer.inject({
|
||||
method: "POST",
|
||||
url: "/api/v1/certificate-profiles",
|
||||
headers: {
|
||||
authorization: `Bearer ${jwtAuthToken}`
|
||||
},
|
||||
body: {
|
||||
projectId,
|
||||
certificateAuthorityId,
|
||||
certificateTemplateId: templateId,
|
||||
name: "Test Profile",
|
||||
slug: "test-profile",
|
||||
description: "A test certificate profile",
|
||||
enrollmentMethod: "api",
|
||||
enrollmentConfig: {
|
||||
apiConfig: {
|
||||
autoRenew: true,
|
||||
autoRenewDays: 30
|
||||
}
|
||||
}
|
||||
}
|
||||
});
|
||||
|
||||
expect(res.statusCode).toBe(200);
|
||||
const payload = JSON.parse(res.payload);
|
||||
expect(payload).toHaveProperty("certificateProfile");
|
||||
expect(payload.certificateProfile).toHaveProperty("id");
|
||||
expect(payload.certificateProfile.name).toBe("Test Profile");
|
||||
expect(payload.certificateProfile.slug).toBe("test-profile");
|
||||
expect(payload.certificateProfile.projectId).toBe(projectId);
|
||||
expect(payload.certificateProfile.certificateAuthorityId).toBe(certificateAuthorityId);
|
||||
expect(payload.certificateProfile.certificateTemplateId).toBe(templateId);
|
||||
|
||||
profileId = payload.certificateProfile.id;
|
||||
});
|
||||
|
||||
test("Should create profile with EST enrollment", async () => {
|
||||
const res = await testServer.inject({
|
||||
method: "POST",
|
||||
url: "/api/v1/certificate-profiles",
|
||||
headers: {
|
||||
authorization: `Bearer ${jwtAuthToken}`
|
||||
},
|
||||
body: {
|
||||
projectId,
|
||||
certificateAuthorityId,
|
||||
certificateTemplateId: templateId,
|
||||
name: "EST Profile",
|
||||
slug: "est-profile",
|
||||
enrollmentMethod: "est",
|
||||
enrollmentConfig: {
|
||||
estConfig: {
|
||||
passphrase: "test-passphrase",
|
||||
disableBootstrapCaValidation: false,
|
||||
encryptedCaChain: "encrypted-ca-chain-data"
|
||||
}
|
||||
}
|
||||
}
|
||||
});
|
||||
|
||||
expect(res.statusCode).toBe(200);
|
||||
const payload = JSON.parse(res.payload);
|
||||
expect(payload.certificateProfile.enrollmentMethod).toBe("est");
|
||||
});
|
||||
|
||||
test("Should fail to create profile with invalid project", async () => {
|
||||
const res = await testServer.inject({
|
||||
method: "POST",
|
||||
url: "/api/v1/certificate-profiles",
|
||||
headers: {
|
||||
authorization: `Bearer ${jwtAuthToken}`
|
||||
},
|
||||
body: {
|
||||
projectId: "invalid-project-id",
|
||||
certificateAuthorityId,
|
||||
certificateTemplateId: templateId,
|
||||
name: "Invalid Profile",
|
||||
slug: "invalid-profile"
|
||||
}
|
||||
});
|
||||
|
||||
expect(res.statusCode).toBe(400);
|
||||
});
|
||||
|
||||
test("Should fail to create profile with duplicate slug", async () => {
|
||||
const res = await testServer.inject({
|
||||
method: "POST",
|
||||
url: "/api/v1/certificate-profiles",
|
||||
headers: {
|
||||
authorization: `Bearer ${jwtAuthToken}`
|
||||
},
|
||||
body: {
|
||||
projectId,
|
||||
certificateAuthorityId,
|
||||
certificateTemplateId: templateId,
|
||||
name: "Duplicate Profile",
|
||||
slug: "test-profile" // Same slug as first profile
|
||||
}
|
||||
});
|
||||
|
||||
expect(res.statusCode).toBe(400);
|
||||
});
|
||||
});
|
||||
|
||||
describe("GET /v1/certificate-profiles", () => {
|
||||
test("Should list certificate profiles", async () => {
|
||||
const res = await testServer.inject({
|
||||
method: "GET",
|
||||
url: `/api/v1/certificate-profiles?projectId=${projectId}`,
|
||||
headers: {
|
||||
authorization: `Bearer ${jwtAuthToken}`
|
||||
}
|
||||
});
|
||||
|
||||
expect(res.statusCode).toBe(200);
|
||||
const payload = JSON.parse(res.payload);
|
||||
expect(payload).toHaveProperty("certificateProfiles");
|
||||
expect(payload).toHaveProperty("totalCount");
|
||||
expect(Array.isArray(payload.certificateProfiles)).toBe(true);
|
||||
expect(payload.totalCount).toBeGreaterThan(0);
|
||||
});
|
||||
|
||||
test("Should support pagination and search", async () => {
|
||||
const res = await testServer.inject({
|
||||
method: "GET",
|
||||
url: `/api/v1/certificate-profiles?projectId=${projectId}&offset=0&limit=1&search=Test`,
|
||||
headers: {
|
||||
authorization: `Bearer ${jwtAuthToken}`
|
||||
}
|
||||
});
|
||||
|
||||
expect(res.statusCode).toBe(200);
|
||||
const payload = JSON.parse(res.payload);
|
||||
expect(payload.certificateProfiles.length).toBeLessThanOrEqual(1);
|
||||
});
|
||||
});
|
||||
|
||||
describe("GET /v1/certificate-profiles/:id", () => {
|
||||
test("Should get certificate profile by ID with configs", async () => {
|
||||
const res = await testServer.inject({
|
||||
method: "GET",
|
||||
url: `/api/v1/certificate-profiles/${profileId}`,
|
||||
headers: {
|
||||
authorization: `Bearer ${jwtAuthToken}`
|
||||
}
|
||||
});
|
||||
|
||||
expect(res.statusCode).toBe(200);
|
||||
const payload = JSON.parse(res.payload);
|
||||
expect(payload).toHaveProperty("certificateProfile");
|
||||
expect(payload.certificateProfile.id).toBe(profileId);
|
||||
expect(payload.certificateProfile.name).toBe("Test Profile");
|
||||
expect(payload.certificateProfile).toHaveProperty("certificateAuthority");
|
||||
expect(payload.certificateProfile).toHaveProperty("certificateTemplate");
|
||||
expect(payload.certificateProfile).toHaveProperty("apiConfig");
|
||||
});
|
||||
|
||||
test("Should return 404 for non-existent profile", async () => {
|
||||
const res = await testServer.inject({
|
||||
method: "GET",
|
||||
url: "/api/v1/certificate-profiles/non-existent-id",
|
||||
headers: {
|
||||
authorization: `Bearer ${jwtAuthToken}`
|
||||
}
|
||||
});
|
||||
|
||||
expect(res.statusCode).toBe(404);
|
||||
});
|
||||
});
|
||||
|
||||
describe("GET /v1/certificate-profiles/slug/:slug", () => {
|
||||
test("Should get certificate profile by slug", async () => {
|
||||
const res = await testServer.inject({
|
||||
method: "GET",
|
||||
url: `/api/v1/certificate-profiles/slug/test-profile?projectId=${projectId}`,
|
||||
headers: {
|
||||
authorization: `Bearer ${jwtAuthToken}`
|
||||
}
|
||||
});
|
||||
|
||||
expect(res.statusCode).toBe(200);
|
||||
const payload = JSON.parse(res.payload);
|
||||
expect(payload).toHaveProperty("certificateProfile");
|
||||
expect(payload.certificateProfile.slug).toBe("test-profile");
|
||||
});
|
||||
|
||||
test("Should return 404 for non-existent slug", async () => {
|
||||
const res = await testServer.inject({
|
||||
method: "GET",
|
||||
url: `/api/v1/certificate-profiles/slug/non-existent?projectId=${projectId}`,
|
||||
headers: {
|
||||
authorization: `Bearer ${jwtAuthToken}`
|
||||
}
|
||||
});
|
||||
|
||||
expect(res.statusCode).toBe(404);
|
||||
});
|
||||
});
|
||||
|
||||
describe("PATCH /v1/certificate-profiles/:id", () => {
|
||||
test("Should update certificate profile", async () => {
|
||||
const res = await testServer.inject({
|
||||
method: "PATCH",
|
||||
url: `/api/v1/certificate-profiles/${profileId}`,
|
||||
headers: {
|
||||
authorization: `Bearer ${jwtAuthToken}`
|
||||
},
|
||||
body: {
|
||||
name: "Updated Test Profile",
|
||||
description: "Updated description",
|
||||
enrollmentConfig: {
|
||||
apiConfig: {
|
||||
autoRenew: false,
|
||||
autoRenewDays: 60
|
||||
}
|
||||
}
|
||||
}
|
||||
});
|
||||
|
||||
expect(res.statusCode).toBe(200);
|
||||
const payload = JSON.parse(res.payload);
|
||||
expect(payload.certificateProfile.name).toBe("Updated Test Profile");
|
||||
expect(payload.certificateProfile.description).toBe("Updated description");
|
||||
});
|
||||
});
|
||||
|
||||
describe("GET /v1/certificate-profiles/:id/certificates", () => {
|
||||
test("Should list certificates for profile", async () => {
|
||||
const res = await testServer.inject({
|
||||
method: "GET",
|
||||
url: `/api/v1/certificate-profiles/${profileId}/certificates`,
|
||||
headers: {
|
||||
authorization: `Bearer ${jwtAuthToken}`
|
||||
}
|
||||
});
|
||||
|
||||
expect(res.statusCode).toBe(200);
|
||||
const payload = JSON.parse(res.payload);
|
||||
expect(payload).toHaveProperty("certificates");
|
||||
expect(Array.isArray(payload.certificates)).toBe(true);
|
||||
});
|
||||
|
||||
test("Should support filtering and pagination", async () => {
|
||||
const res = await testServer.inject({
|
||||
method: "GET",
|
||||
url: `/api/v1/certificate-profiles/${profileId}/certificates?status=active&offset=0&limit=10`,
|
||||
headers: {
|
||||
authorization: `Bearer ${jwtAuthToken}`
|
||||
}
|
||||
});
|
||||
|
||||
expect(res.statusCode).toBe(200);
|
||||
const payload = JSON.parse(res.payload);
|
||||
expect(payload.certificates.length).toBeLessThanOrEqual(10);
|
||||
});
|
||||
});
|
||||
|
||||
describe("GET /v1/certificate-profiles/:id/metrics", () => {
|
||||
test("Should get profile metrics", async () => {
|
||||
const res = await testServer.inject({
|
||||
method: "GET",
|
||||
url: `/api/v1/certificate-profiles/${profileId}/metrics?expiringDays=30`,
|
||||
headers: {
|
||||
authorization: `Bearer ${jwtAuthToken}`
|
||||
}
|
||||
});
|
||||
|
||||
expect(res.statusCode).toBe(200);
|
||||
const payload = JSON.parse(res.payload);
|
||||
expect(payload).toHaveProperty("metrics");
|
||||
expect(payload.metrics).toHaveProperty("profileId");
|
||||
expect(payload.metrics).toHaveProperty("totalCertificates");
|
||||
expect(payload.metrics).toHaveProperty("activeCertificates");
|
||||
expect(payload.metrics).toHaveProperty("expiredCertificates");
|
||||
expect(payload.metrics).toHaveProperty("expiringCertificates");
|
||||
expect(payload.metrics).toHaveProperty("revokedCertificates");
|
||||
expect(payload.metrics.profileId).toBe(profileId);
|
||||
});
|
||||
});
|
||||
|
||||
describe("DELETE /v1/certificate-profiles/:id", () => {
|
||||
test("Should delete certificate profile", async () => {
|
||||
const res = await testServer.inject({
|
||||
method: "DELETE",
|
||||
url: `/api/v1/certificate-profiles/${profileId}`,
|
||||
headers: {
|
||||
authorization: `Bearer ${jwtAuthToken}`
|
||||
}
|
||||
});
|
||||
|
||||
expect(res.statusCode).toBe(200);
|
||||
const payload = JSON.parse(res.payload);
|
||||
expect(payload).toHaveProperty("certificateProfile");
|
||||
expect(payload.certificateProfile.id).toBe(profileId);
|
||||
});
|
||||
|
||||
test("Should return 404 when deleting non-existent profile", async () => {
|
||||
const res = await testServer.inject({
|
||||
method: "DELETE",
|
||||
url: `/api/v1/certificate-profiles/${profileId}`,
|
||||
headers: {
|
||||
authorization: `Bearer ${jwtAuthToken}`
|
||||
}
|
||||
});
|
||||
|
||||
expect(res.statusCode).toBe(404);
|
||||
});
|
||||
});
|
||||
|
||||
describe("Authentication", () => {
|
||||
test("Should require authentication", async () => {
|
||||
const res = await testServer.inject({
|
||||
method: "GET",
|
||||
url: `/api/v1/certificate-profiles?projectId=${projectId}`
|
||||
});
|
||||
|
||||
expect(res.statusCode).toBe(401);
|
||||
});
|
||||
|
||||
test("Should reject invalid token", async () => {
|
||||
const res = await testServer.inject({
|
||||
method: "GET",
|
||||
url: `/api/v1/certificate-profiles?projectId=${projectId}`,
|
||||
headers: {
|
||||
authorization: "Bearer invalid-token"
|
||||
}
|
||||
});
|
||||
|
||||
expect(res.statusCode).toBe(401);
|
||||
});
|
||||
});
|
||||
});
|
||||
@@ -1,292 +0,0 @@
|
||||
import { seedData1 } from "@app/db/seed-data";
|
||||
|
||||
describe("Certificate Templates V2 Router", () => {
|
||||
let projectId: string;
|
||||
let certificateAuthorityId: string;
|
||||
let templateId: string;
|
||||
|
||||
beforeAll(async () => {
|
||||
projectId = seedData1.project.id;
|
||||
|
||||
// Create a test certificate authority first
|
||||
const caRes = await testServer.inject({
|
||||
method: "POST",
|
||||
url: "/api/v1/pki/ca",
|
||||
headers: {
|
||||
authorization: `Bearer ${jwtAuthToken}`
|
||||
},
|
||||
body: {
|
||||
projectSlug: seedData1.project.slug,
|
||||
type: "root",
|
||||
friendlyName: "Test Root CA",
|
||||
organization: "Test Org",
|
||||
ou: "Test OU",
|
||||
country: "US",
|
||||
province: "CA",
|
||||
locality: "San Francisco",
|
||||
commonName: "Test Root CA",
|
||||
ttl: "8760h"
|
||||
}
|
||||
});
|
||||
expect(caRes.statusCode).toBe(200);
|
||||
const caPayload = JSON.parse(caRes.payload);
|
||||
certificateAuthorityId = caPayload.certificateAuthority.id;
|
||||
});
|
||||
|
||||
describe("POST /v2/certificate-templates", () => {
|
||||
test("Should create a certificate template v2", async () => {
|
||||
const res = await testServer.inject({
|
||||
method: "POST",
|
||||
url: "/api/v2/certificate-templates",
|
||||
headers: {
|
||||
authorization: `Bearer ${jwtAuthToken}`
|
||||
},
|
||||
body: {
|
||||
projectId,
|
||||
certificateAuthorityId,
|
||||
name: "Test Template V2",
|
||||
description: "A test certificate template v2",
|
||||
policy: {
|
||||
allowedDomains: ["example.com", "*.example.com"],
|
||||
allowWildcards: true,
|
||||
allowAnyName: false,
|
||||
allowIpSans: false,
|
||||
allowSubdomains: true,
|
||||
maxTtl: "8760h",
|
||||
keyUsages: ["digital_signature", "key_agreement"],
|
||||
extendedKeyUsages: ["server_auth", "client_auth"],
|
||||
organizationPolicy: {
|
||||
allowedOrganizations: ["Test Org"],
|
||||
enforceOrganization: true
|
||||
},
|
||||
subjectPolicy: {
|
||||
allowedCountries: ["US", "CA"],
|
||||
allowedProvinces: ["CA", "NY"],
|
||||
allowedLocalities: ["San Francisco", "New York"],
|
||||
enforceSubject: false
|
||||
}
|
||||
}
|
||||
}
|
||||
});
|
||||
|
||||
expect(res.statusCode).toBe(200);
|
||||
const payload = JSON.parse(res.payload);
|
||||
expect(payload).toHaveProperty("certificateTemplate");
|
||||
expect(payload.certificateTemplate).toHaveProperty("id");
|
||||
expect(payload.certificateTemplate.name).toBe("Test Template V2");
|
||||
expect(payload.certificateTemplate.projectId).toBe(projectId);
|
||||
expect(payload.certificateTemplate.certificateAuthorityId).toBe(certificateAuthorityId);
|
||||
|
||||
templateId = payload.certificateTemplate.id;
|
||||
});
|
||||
|
||||
test("Should fail to create template with invalid project", async () => {
|
||||
const res = await testServer.inject({
|
||||
method: "POST",
|
||||
url: "/api/v2/certificate-templates",
|
||||
headers: {
|
||||
authorization: `Bearer ${jwtAuthToken}`
|
||||
},
|
||||
body: {
|
||||
projectId: "invalid-project-id",
|
||||
certificateAuthorityId,
|
||||
name: "Invalid Template",
|
||||
policy: {}
|
||||
}
|
||||
});
|
||||
|
||||
expect(res.statusCode).toBe(400);
|
||||
});
|
||||
});
|
||||
|
||||
describe("GET /v2/certificate-templates", () => {
|
||||
test("Should list certificate templates v2", async () => {
|
||||
const res = await testServer.inject({
|
||||
method: "GET",
|
||||
url: `/api/v2/certificate-templates?projectId=${projectId}`,
|
||||
headers: {
|
||||
authorization: `Bearer ${jwtAuthToken}`
|
||||
}
|
||||
});
|
||||
|
||||
expect(res.statusCode).toBe(200);
|
||||
const payload = JSON.parse(res.payload);
|
||||
expect(payload).toHaveProperty("certificateTemplates");
|
||||
expect(payload).toHaveProperty("totalCount");
|
||||
expect(Array.isArray(payload.certificateTemplates)).toBe(true);
|
||||
expect(payload.totalCount).toBeGreaterThan(0);
|
||||
});
|
||||
|
||||
test("Should support pagination", async () => {
|
||||
const res = await testServer.inject({
|
||||
method: "GET",
|
||||
url: `/api/v2/certificate-templates?projectId=${projectId}&offset=0&limit=1`,
|
||||
headers: {
|
||||
authorization: `Bearer ${jwtAuthToken}`
|
||||
}
|
||||
});
|
||||
|
||||
expect(res.statusCode).toBe(200);
|
||||
const payload = JSON.parse(res.payload);
|
||||
expect(payload.certificateTemplates.length).toBeLessThanOrEqual(1);
|
||||
});
|
||||
});
|
||||
|
||||
describe("GET /v2/certificate-templates/:id", () => {
|
||||
test("Should get certificate template v2 by ID", async () => {
|
||||
const res = await testServer.inject({
|
||||
method: "GET",
|
||||
url: `/api/v2/certificate-templates/${templateId}`,
|
||||
headers: {
|
||||
authorization: `Bearer ${jwtAuthToken}`
|
||||
}
|
||||
});
|
||||
|
||||
expect(res.statusCode).toBe(200);
|
||||
const payload = JSON.parse(res.payload);
|
||||
expect(payload).toHaveProperty("certificateTemplate");
|
||||
expect(payload.certificateTemplate.id).toBe(templateId);
|
||||
expect(payload.certificateTemplate.name).toBe("Test Template V2");
|
||||
});
|
||||
|
||||
test("Should return 404 for non-existent template", async () => {
|
||||
const res = await testServer.inject({
|
||||
method: "GET",
|
||||
url: "/api/v2/certificate-templates/non-existent-id",
|
||||
headers: {
|
||||
authorization: `Bearer ${jwtAuthToken}`
|
||||
}
|
||||
});
|
||||
|
||||
expect(res.statusCode).toBe(404);
|
||||
});
|
||||
});
|
||||
|
||||
describe("PATCH /v2/certificate-templates/:id", () => {
|
||||
test("Should update certificate template v2", async () => {
|
||||
const res = await testServer.inject({
|
||||
method: "PATCH",
|
||||
url: `/api/v2/certificate-templates/${templateId}`,
|
||||
headers: {
|
||||
authorization: `Bearer ${jwtAuthToken}`
|
||||
},
|
||||
body: {
|
||||
name: "Updated Test Template V2",
|
||||
description: "Updated description",
|
||||
policy: {
|
||||
allowedDomains: ["updated.com"],
|
||||
allowWildcards: false,
|
||||
maxTtl: "4380h"
|
||||
}
|
||||
}
|
||||
});
|
||||
|
||||
expect(res.statusCode).toBe(200);
|
||||
const payload = JSON.parse(res.payload);
|
||||
expect(payload.certificateTemplate.name).toBe("Updated Test Template V2");
|
||||
expect(payload.certificateTemplate.description).toBe("Updated description");
|
||||
});
|
||||
});
|
||||
|
||||
describe("POST /v2/certificate-templates/:id/validate", () => {
|
||||
test("Should validate certificate request against template policy", async () => {
|
||||
const res = await testServer.inject({
|
||||
method: "POST",
|
||||
url: `/api/v2/certificate-templates/${templateId}/validate`,
|
||||
headers: {
|
||||
authorization: `Bearer ${jwtAuthToken}`
|
||||
},
|
||||
body: {
|
||||
request: {
|
||||
commonName: "test.updated.com",
|
||||
ttl: "24h",
|
||||
keyUsages: ["digital_signature"],
|
||||
extendedKeyUsages: ["server_auth"]
|
||||
}
|
||||
}
|
||||
});
|
||||
|
||||
expect(res.statusCode).toBe(200);
|
||||
const payload = JSON.parse(res.payload);
|
||||
expect(payload).toHaveProperty("valid");
|
||||
expect(typeof payload.valid).toBe("boolean");
|
||||
if (!payload.valid) {
|
||||
expect(payload).toHaveProperty("errors");
|
||||
expect(Array.isArray(payload.errors)).toBe(true);
|
||||
}
|
||||
});
|
||||
|
||||
test("Should reject invalid certificate request", async () => {
|
||||
const res = await testServer.inject({
|
||||
method: "POST",
|
||||
url: `/api/v2/certificate-templates/${templateId}/validate`,
|
||||
headers: {
|
||||
authorization: `Bearer ${jwtAuthToken}`
|
||||
},
|
||||
body: {
|
||||
request: {
|
||||
commonName: "invalid.domain.com", // Not in allowed domains
|
||||
ttl: "24h"
|
||||
}
|
||||
}
|
||||
});
|
||||
|
||||
expect(res.statusCode).toBe(200);
|
||||
const payload = JSON.parse(res.payload);
|
||||
expect(payload.valid).toBe(false);
|
||||
expect(payload.errors).toBeDefined();
|
||||
});
|
||||
});
|
||||
|
||||
describe("DELETE /v2/certificate-templates/:id", () => {
|
||||
test("Should delete certificate template v2", async () => {
|
||||
const res = await testServer.inject({
|
||||
method: "DELETE",
|
||||
url: `/api/v2/certificate-templates/${templateId}`,
|
||||
headers: {
|
||||
authorization: `Bearer ${jwtAuthToken}`
|
||||
}
|
||||
});
|
||||
|
||||
expect(res.statusCode).toBe(200);
|
||||
const payload = JSON.parse(res.payload);
|
||||
expect(payload).toHaveProperty("certificateTemplate");
|
||||
expect(payload.certificateTemplate.id).toBe(templateId);
|
||||
});
|
||||
|
||||
test("Should return 404 when deleting non-existent template", async () => {
|
||||
const res = await testServer.inject({
|
||||
method: "DELETE",
|
||||
url: `/api/v2/certificate-templates/${templateId}`,
|
||||
headers: {
|
||||
authorization: `Bearer ${jwtAuthToken}`
|
||||
}
|
||||
});
|
||||
|
||||
expect(res.statusCode).toBe(404);
|
||||
});
|
||||
});
|
||||
|
||||
describe("Authentication", () => {
|
||||
test("Should require authentication", async () => {
|
||||
const res = await testServer.inject({
|
||||
method: "GET",
|
||||
url: `/api/v2/certificate-templates?projectId=${projectId}`
|
||||
});
|
||||
|
||||
expect(res.statusCode).toBe(401);
|
||||
});
|
||||
|
||||
test("Should reject invalid token", async () => {
|
||||
const res = await testServer.inject({
|
||||
method: "GET",
|
||||
url: `/api/v2/certificate-templates?projectId=${projectId}`,
|
||||
headers: {
|
||||
authorization: "Bearer invalid-token"
|
||||
}
|
||||
});
|
||||
|
||||
expect(res.statusCode).toBe(401);
|
||||
});
|
||||
});
|
||||
});
|
||||
@@ -1,855 +0,0 @@
|
||||
import { seedData1 } from "@app/db/seed-data";
|
||||
|
||||
describe("Certificates V3 Router", () => {
|
||||
let projectId: string;
|
||||
let certificateAuthorityId: string;
|
||||
let templateId: string;
|
||||
let profileId: string;
|
||||
|
||||
beforeAll(async () => {
|
||||
projectId = seedData1.project.id;
|
||||
|
||||
// Create a test certificate authority first
|
||||
const caRes = await testServer.inject({
|
||||
method: "POST",
|
||||
url: "/api/v1/pki/ca",
|
||||
headers: {
|
||||
authorization: `Bearer ${jwtAuthToken}`
|
||||
},
|
||||
body: {
|
||||
projectSlug: seedData1.project.slug,
|
||||
type: "root",
|
||||
friendlyName: "Test Root CA",
|
||||
organization: "Test Org",
|
||||
ou: "Test OU",
|
||||
country: "US",
|
||||
province: "CA",
|
||||
locality: "San Francisco",
|
||||
commonName: "Test Root CA",
|
||||
ttl: "8760h"
|
||||
}
|
||||
});
|
||||
expect(caRes.statusCode).toBe(200);
|
||||
const caPayload = JSON.parse(caRes.payload);
|
||||
certificateAuthorityId = caPayload.certificateAuthority.id;
|
||||
|
||||
// Create a test certificate template v2 with proper V2 structure
|
||||
const templateRes = await testServer.inject({
|
||||
method: "POST",
|
||||
url: "/api/v2/certificate-templates",
|
||||
headers: {
|
||||
authorization: `Bearer ${jwtAuthToken}`
|
||||
},
|
||||
body: {
|
||||
projectId,
|
||||
name: "Test Template for V3",
|
||||
description: "Template for testing V3 certificate endpoints",
|
||||
attributes: [
|
||||
{
|
||||
type: "common_name",
|
||||
include: "optional",
|
||||
value: ["*.example.com", "example.com"]
|
||||
},
|
||||
{
|
||||
type: "organization_name",
|
||||
include: "optional"
|
||||
},
|
||||
{
|
||||
type: "country",
|
||||
include: "optional",
|
||||
value: ["US", "CA"]
|
||||
}
|
||||
],
|
||||
keyUsages: {
|
||||
requiredUsages: {
|
||||
all: ["digital_signature"]
|
||||
},
|
||||
optionalUsages: {
|
||||
all: ["key_encipherment", "key_agreement"]
|
||||
}
|
||||
},
|
||||
extendedKeyUsages: {
|
||||
requiredUsages: {
|
||||
all: ["server_auth"]
|
||||
},
|
||||
optionalUsages: {
|
||||
all: ["client_auth"]
|
||||
}
|
||||
},
|
||||
subjectAlternativeNames: [
|
||||
{
|
||||
type: "dns_name",
|
||||
include: "optional",
|
||||
value: ["*.example.com", "example.com"]
|
||||
}
|
||||
],
|
||||
validity: {
|
||||
maxDuration: {
|
||||
value: 365,
|
||||
unit: "days"
|
||||
}
|
||||
}
|
||||
}
|
||||
});
|
||||
expect(templateRes.statusCode).toBe(200);
|
||||
const templatePayload = JSON.parse(templateRes.payload);
|
||||
templateId = templatePayload.certificateTemplate.id;
|
||||
|
||||
// Create a test certificate profile
|
||||
const profileRes = await testServer.inject({
|
||||
method: "POST",
|
||||
url: "/api/v1/certificate-profiles",
|
||||
headers: {
|
||||
authorization: `Bearer ${jwtAuthToken}`
|
||||
},
|
||||
body: {
|
||||
projectId,
|
||||
certificateAuthorityId,
|
||||
certificateTemplateId: templateId,
|
||||
name: "Test Profile for V3",
|
||||
slug: "test-profile-v3",
|
||||
enrollmentMethod: "api",
|
||||
enrollmentConfig: {
|
||||
apiConfig: {
|
||||
autoRenew: false
|
||||
}
|
||||
}
|
||||
}
|
||||
});
|
||||
expect(profileRes.statusCode).toBe(200);
|
||||
const profilePayload = JSON.parse(profileRes.payload);
|
||||
profileId = profilePayload.certificateProfile.id;
|
||||
});
|
||||
|
||||
describe("POST /v3/certificates/issue-certificate", () => {
|
||||
test("Should issue a certificate using profileId", async () => {
|
||||
const res = await testServer.inject({
|
||||
method: "POST",
|
||||
url: "/api/v3/certificates/issue-certificate",
|
||||
headers: {
|
||||
authorization: `Bearer ${jwtAuthToken}`
|
||||
},
|
||||
body: {
|
||||
profileId,
|
||||
certificateRequest: {
|
||||
commonName: "test.example.com",
|
||||
organization: "Test Org",
|
||||
organizationUnit: "Test OU",
|
||||
locality: "San Francisco",
|
||||
state: "CA",
|
||||
country: "US",
|
||||
email: "test@example.com",
|
||||
keyUsages: ["digitalSignature"],
|
||||
extendedKeyUsages: ["serverAuth"],
|
||||
subjectAlternativeNames: [
|
||||
{
|
||||
type: "dns_name",
|
||||
value: "www.example.com"
|
||||
},
|
||||
{
|
||||
type: "dns_name",
|
||||
value: "api.example.com"
|
||||
}
|
||||
],
|
||||
validity: {
|
||||
ttl: "24h"
|
||||
}
|
||||
}
|
||||
}
|
||||
});
|
||||
|
||||
expect(res.statusCode).toBe(200);
|
||||
const payload = JSON.parse(res.payload);
|
||||
expect(payload).toHaveProperty("certificate");
|
||||
expect(payload).toHaveProperty("issuingCaCertificate");
|
||||
expect(payload).toHaveProperty("certificateChain");
|
||||
expect(payload).toHaveProperty("privateKey");
|
||||
expect(payload).toHaveProperty("serialNumber");
|
||||
expect(payload).toHaveProperty("certificateId");
|
||||
|
||||
// Verify certificate fields
|
||||
expect(typeof payload.certificate).toBe("string");
|
||||
expect(payload.certificate.includes("BEGIN CERTIFICATE")).toBe(true);
|
||||
expect(typeof payload.privateKey).toBe("string");
|
||||
expect(payload.privateKey.includes("BEGIN PRIVATE KEY")).toBe(true);
|
||||
});
|
||||
|
||||
test("Should fail with invalid profileId", async () => {
|
||||
const res = await testServer.inject({
|
||||
method: "POST",
|
||||
url: "/api/v3/certificates/issue-certificate",
|
||||
headers: {
|
||||
authorization: `Bearer ${jwtAuthToken}`
|
||||
},
|
||||
body: {
|
||||
profileId: "invalid-profile-id",
|
||||
certificateRequest: {
|
||||
commonName: "test.example.com",
|
||||
validity: {
|
||||
ttl: "24h"
|
||||
}
|
||||
}
|
||||
}
|
||||
});
|
||||
|
||||
expect(res.statusCode).toBe(404);
|
||||
});
|
||||
|
||||
test("Should fail with domain not allowed by policy", async () => {
|
||||
const res = await testServer.inject({
|
||||
method: "POST",
|
||||
url: "/api/v3/certificates/issue-certificate",
|
||||
headers: {
|
||||
authorization: `Bearer ${jwtAuthToken}`
|
||||
},
|
||||
body: {
|
||||
profileId,
|
||||
certificateRequest: {
|
||||
commonName: "test.notallowed.com",
|
||||
validity: {
|
||||
ttl: "24h"
|
||||
}
|
||||
}
|
||||
}
|
||||
});
|
||||
|
||||
expect(res.statusCode).toBe(400);
|
||||
});
|
||||
|
||||
test("Should fail with invalid TTL", async () => {
|
||||
const res = await testServer.inject({
|
||||
method: "POST",
|
||||
url: "/api/v3/certificates/issue-certificate",
|
||||
headers: {
|
||||
authorization: `Bearer ${jwtAuthToken}`
|
||||
},
|
||||
body: {
|
||||
profileId,
|
||||
certificateRequest: {
|
||||
commonName: "test.example.com",
|
||||
validity: {
|
||||
ttl: "invalid-ttl"
|
||||
}
|
||||
}
|
||||
}
|
||||
});
|
||||
|
||||
expect(res.statusCode).toBe(400);
|
||||
});
|
||||
|
||||
test("Should handle wildcard certificates", async () => {
|
||||
const res = await testServer.inject({
|
||||
method: "POST",
|
||||
url: "/api/v3/certificates/issue-certificate",
|
||||
headers: {
|
||||
authorization: `Bearer ${jwtAuthToken}`
|
||||
},
|
||||
body: {
|
||||
profileId,
|
||||
certificateRequest: {
|
||||
commonName: "*.example.com",
|
||||
validity: {
|
||||
ttl: "24h"
|
||||
}
|
||||
}
|
||||
}
|
||||
});
|
||||
|
||||
expect(res.statusCode).toBe(200);
|
||||
const payload = JSON.parse(res.payload);
|
||||
expect(payload).toHaveProperty("certificate");
|
||||
});
|
||||
|
||||
test("Should validate certificate with profile policy", async () => {
|
||||
const res = await testServer.inject({
|
||||
method: "POST",
|
||||
url: "/api/v3/certificates/issue-certificate",
|
||||
headers: {
|
||||
authorization: `Bearer ${jwtAuthToken}`
|
||||
},
|
||||
body: {
|
||||
profileId,
|
||||
certificateRequest: {
|
||||
commonName: "app.example.com",
|
||||
keyUsages: ["digitalSignature"], // Required by template
|
||||
extendedKeyUsages: ["serverAuth"], // Required by template
|
||||
validity: {
|
||||
ttl: "24h"
|
||||
}
|
||||
}
|
||||
}
|
||||
});
|
||||
|
||||
expect(res.statusCode).toBe(200);
|
||||
const payload = JSON.parse(res.payload);
|
||||
expect(payload).toHaveProperty("certificate");
|
||||
expect(payload).toHaveProperty("certificateId");
|
||||
|
||||
// Verify the certificate was created with profile reference
|
||||
expect(typeof payload.certificateId).toBe("string");
|
||||
expect(payload.certificateId.length).toBeGreaterThan(0);
|
||||
});
|
||||
});
|
||||
|
||||
describe("POST /v3/certificates/sign-certificate", () => {
|
||||
let testCSR: string;
|
||||
|
||||
beforeAll(() => {
|
||||
// Mock CSR for testing - in real tests you'd generate a proper CSR
|
||||
testCSR = `-----BEGIN CERTIFICATE REQUEST-----
|
||||
MIICWjCCAUICAQAwFTETMBEGA1UEAwwKdGVzdC5jb20uY2ExXDANBgkqhkiG9w0B
|
||||
AQEFAAOBiQAwgYUCgYEAyKdVQNK5Wf7V8qU2tU3hV7g4+OJ+Xz8TzL1Q2u8cQ9v
|
||||
...mock CSR content...
|
||||
yK5ZqN8U3QR7yB+X9vG1eI+dA==
|
||||
-----END CERTIFICATE REQUEST-----`;
|
||||
});
|
||||
|
||||
test("Should sign a CSR using profileId", async () => {
|
||||
const res = await testServer.inject({
|
||||
method: "POST",
|
||||
url: "/api/v3/certificates/sign-certificate",
|
||||
headers: {
|
||||
authorization: `Bearer ${jwtAuthToken}`
|
||||
},
|
||||
body: {
|
||||
profileId,
|
||||
csr: testCSR,
|
||||
validity: {
|
||||
ttl: "24h"
|
||||
}
|
||||
}
|
||||
});
|
||||
|
||||
expect([200, 400]).toContain(res.statusCode);
|
||||
|
||||
if (res.statusCode === 200) {
|
||||
const payload = JSON.parse(res.payload);
|
||||
expect(payload).toHaveProperty("certificate");
|
||||
expect(payload).toHaveProperty("issuingCaCertificate");
|
||||
expect(payload).toHaveProperty("certificateChain");
|
||||
expect(payload).toHaveProperty("serialNumber");
|
||||
expect(payload).toHaveProperty("certificateId");
|
||||
|
||||
// Verify the certificate was created with profile reference
|
||||
expect(typeof payload.certificateId).toBe("string");
|
||||
expect(payload.certificateId.length).toBeGreaterThan(0);
|
||||
}
|
||||
});
|
||||
|
||||
test("Should fail with invalid CSR", async () => {
|
||||
const res = await testServer.inject({
|
||||
method: "POST",
|
||||
url: "/api/v3/certificates/sign-certificate",
|
||||
headers: {
|
||||
authorization: `Bearer ${jwtAuthToken}`
|
||||
},
|
||||
body: {
|
||||
profileId,
|
||||
csr: "invalid-csr",
|
||||
validity: {
|
||||
ttl: "24h"
|
||||
}
|
||||
}
|
||||
});
|
||||
|
||||
expect(res.statusCode).toBe(400);
|
||||
});
|
||||
|
||||
test("Should fail with empty CSR", async () => {
|
||||
const res = await testServer.inject({
|
||||
method: "POST",
|
||||
url: "/api/v3/certificates/sign-certificate",
|
||||
headers: {
|
||||
authorization: `Bearer ${jwtAuthToken}`
|
||||
},
|
||||
body: {
|
||||
profileId,
|
||||
csr: "",
|
||||
validity: {
|
||||
ttl: "24h"
|
||||
}
|
||||
}
|
||||
});
|
||||
|
||||
expect(res.statusCode).toBe(400);
|
||||
});
|
||||
|
||||
test("Should fail with invalid profileId for CSR signing", async () => {
|
||||
const res = await testServer.inject({
|
||||
method: "POST",
|
||||
url: "/api/v3/certificates/sign-certificate",
|
||||
headers: {
|
||||
authorization: `Bearer ${jwtAuthToken}`
|
||||
},
|
||||
body: {
|
||||
profileId: "invalid-profile-id",
|
||||
csr: testCSR,
|
||||
validity: {
|
||||
ttl: "24h"
|
||||
}
|
||||
}
|
||||
});
|
||||
|
||||
expect(res.statusCode).toBe(404);
|
||||
});
|
||||
});
|
||||
|
||||
describe("POST /v3/certificates/order-certificate", () => {
|
||||
test("Should create a certificate order using profileId", async () => {
|
||||
const res = await testServer.inject({
|
||||
method: "POST",
|
||||
url: "/api/v3/certificates/order-certificate",
|
||||
headers: {
|
||||
authorization: `Bearer ${jwtAuthToken}`
|
||||
},
|
||||
body: {
|
||||
profileId,
|
||||
certificateOrder: {
|
||||
identifiers: [
|
||||
{
|
||||
type: "dns",
|
||||
value: "test.example.com"
|
||||
},
|
||||
{
|
||||
type: "dns",
|
||||
value: "www.example.com"
|
||||
}
|
||||
],
|
||||
validity: {
|
||||
ttl: "24h"
|
||||
},
|
||||
commonName: "test.example.com",
|
||||
keyUsages: ["digitalSignature"],
|
||||
extendedKeyUsages: ["serverAuth"],
|
||||
organization: "Test Org"
|
||||
}
|
||||
}
|
||||
});
|
||||
|
||||
expect(res.statusCode).toBe(200);
|
||||
const payload = JSON.parse(res.payload);
|
||||
expect(payload).toHaveProperty("orderId");
|
||||
expect(payload).toHaveProperty("status");
|
||||
expect(payload).toHaveProperty("identifiers");
|
||||
expect(payload).toHaveProperty("authorizations");
|
||||
expect(payload).toHaveProperty("finalize");
|
||||
|
||||
// Verify order structure
|
||||
expect(Array.isArray(payload.identifiers)).toBe(true);
|
||||
expect(payload.identifiers.length).toBe(2);
|
||||
expect(Array.isArray(payload.authorizations)).toBe(true);
|
||||
expect(["pending", "processing", "valid", "invalid"]).toContain(payload.status);
|
||||
});
|
||||
|
||||
test("Should fail with invalid identifiers", async () => {
|
||||
const res = await testServer.inject({
|
||||
method: "POST",
|
||||
url: "/api/v3/certificates/order-certificate",
|
||||
headers: {
|
||||
authorization: `Bearer ${jwtAuthToken}`
|
||||
},
|
||||
body: {
|
||||
profileId,
|
||||
certificateOrder: {
|
||||
identifiers: [], // Empty identifiers
|
||||
validity: {
|
||||
ttl: "24h"
|
||||
}
|
||||
}
|
||||
}
|
||||
});
|
||||
|
||||
expect(res.statusCode).toBe(400);
|
||||
});
|
||||
|
||||
test("Should fail with disallowed domains", async () => {
|
||||
const res = await testServer.inject({
|
||||
method: "POST",
|
||||
url: "/api/v3/certificates/order-certificate",
|
||||
headers: {
|
||||
authorization: `Bearer ${jwtAuthToken}`
|
||||
},
|
||||
body: {
|
||||
profileId,
|
||||
certificateOrder: {
|
||||
identifiers: [
|
||||
{
|
||||
type: "dns",
|
||||
value: "test.notallowed.com"
|
||||
}
|
||||
],
|
||||
validity: {
|
||||
ttl: "24h"
|
||||
}
|
||||
}
|
||||
}
|
||||
});
|
||||
|
||||
expect(res.statusCode).toBe(400);
|
||||
});
|
||||
|
||||
test("Should handle IP identifiers", async () => {
|
||||
const res = await testServer.inject({
|
||||
method: "POST",
|
||||
url: "/api/v3/certificates/order-certificate",
|
||||
headers: {
|
||||
authorization: `Bearer ${jwtAuthToken}`
|
||||
},
|
||||
body: {
|
||||
profileId,
|
||||
certificateOrder: {
|
||||
identifiers: [
|
||||
{
|
||||
type: "ip",
|
||||
value: "192.168.1.1"
|
||||
}
|
||||
],
|
||||
validity: {
|
||||
ttl: "24h"
|
||||
}
|
||||
}
|
||||
}
|
||||
});
|
||||
|
||||
expect([200, 400]).toContain(res.statusCode);
|
||||
});
|
||||
|
||||
test("Should validate order against template policy", async () => {
|
||||
const res = await testServer.inject({
|
||||
method: "POST",
|
||||
url: "/api/v3/certificates/order-certificate",
|
||||
headers: {
|
||||
authorization: `Bearer ${jwtAuthToken}`
|
||||
},
|
||||
body: {
|
||||
profileId,
|
||||
certificateOrder: {
|
||||
identifiers: [
|
||||
{
|
||||
type: "dns",
|
||||
value: "api.example.com"
|
||||
}
|
||||
],
|
||||
validity: {
|
||||
ttl: "24h"
|
||||
},
|
||||
commonName: "api.example.com",
|
||||
keyUsages: ["digitalSignature"], // Required by template
|
||||
extendedKeyUsages: ["serverAuth"], // Required by template
|
||||
organization: "Test Org"
|
||||
}
|
||||
}
|
||||
});
|
||||
|
||||
expect(res.statusCode).toBe(200);
|
||||
const payload = JSON.parse(res.payload);
|
||||
expect(payload).toHaveProperty("orderId");
|
||||
expect(payload.status).toBe("valid");
|
||||
});
|
||||
|
||||
test("Should fail with invalid profileId for ordering", async () => {
|
||||
const res = await testServer.inject({
|
||||
method: "POST",
|
||||
url: "/api/v3/certificates/order-certificate",
|
||||
headers: {
|
||||
authorization: `Bearer ${jwtAuthToken}`
|
||||
},
|
||||
body: {
|
||||
profileId: "invalid-profile-id",
|
||||
certificateOrder: {
|
||||
identifiers: [
|
||||
{
|
||||
type: "dns",
|
||||
value: "test.example.com"
|
||||
}
|
||||
],
|
||||
validity: {
|
||||
ttl: "24h"
|
||||
}
|
||||
}
|
||||
}
|
||||
});
|
||||
|
||||
expect(res.statusCode).toBe(404);
|
||||
});
|
||||
});
|
||||
|
||||
describe("Validation and Error Handling", () => {
|
||||
test("Should validate TTL format", async () => {
|
||||
const res = await testServer.inject({
|
||||
method: "POST",
|
||||
url: "/api/v3/certificates/issue-certificate",
|
||||
headers: {
|
||||
authorization: `Bearer ${jwtAuthToken}`
|
||||
},
|
||||
body: {
|
||||
profileId,
|
||||
certificateRequest: {
|
||||
commonName: "test.example.com",
|
||||
validity: {
|
||||
ttl: "0h" // Invalid TTL
|
||||
}
|
||||
}
|
||||
}
|
||||
});
|
||||
|
||||
expect(res.statusCode).toBe(400);
|
||||
});
|
||||
|
||||
test("Should validate country code format", async () => {
|
||||
const res = await testServer.inject({
|
||||
method: "POST",
|
||||
url: "/api/v3/certificates/issue-certificate",
|
||||
headers: {
|
||||
authorization: `Bearer ${jwtAuthToken}`
|
||||
},
|
||||
body: {
|
||||
profileId,
|
||||
certificateRequest: {
|
||||
commonName: "test.example.com",
|
||||
validity: {
|
||||
ttl: "24h"
|
||||
},
|
||||
country: "USA" // Invalid - should be 2 characters
|
||||
}
|
||||
}
|
||||
});
|
||||
|
||||
expect(res.statusCode).toBe(400);
|
||||
});
|
||||
|
||||
test("Should validate email format", async () => {
|
||||
const res = await testServer.inject({
|
||||
method: "POST",
|
||||
url: "/api/v3/certificates/issue-certificate",
|
||||
headers: {
|
||||
authorization: `Bearer ${jwtAuthToken}`
|
||||
},
|
||||
body: {
|
||||
profileId,
|
||||
certificateRequest: {
|
||||
commonName: "test.example.com",
|
||||
validity: {
|
||||
ttl: "24h"
|
||||
},
|
||||
email: "invalid-email" // Invalid email format
|
||||
}
|
||||
}
|
||||
});
|
||||
|
||||
expect(res.statusCode).toBe(400);
|
||||
});
|
||||
|
||||
test("Should validate key usage requirements", async () => {
|
||||
const res = await testServer.inject({
|
||||
method: "POST",
|
||||
url: "/api/v3/certificates/issue-certificate",
|
||||
headers: {
|
||||
authorization: `Bearer ${jwtAuthToken}`
|
||||
},
|
||||
body: {
|
||||
profileId,
|
||||
certificateRequest: {
|
||||
commonName: "test.example.com",
|
||||
validity: {
|
||||
ttl: "24h"
|
||||
},
|
||||
keyUsages: [], // Missing required key usages
|
||||
extendedKeyUsages: [] // Missing required extended key usages
|
||||
}
|
||||
}
|
||||
});
|
||||
|
||||
expect(res.statusCode).toBe(400);
|
||||
});
|
||||
|
||||
test("Should handle empty certificate request", async () => {
|
||||
const res = await testServer.inject({
|
||||
method: "POST",
|
||||
url: "/api/v3/certificates/issue-certificate",
|
||||
headers: {
|
||||
authorization: `Bearer ${jwtAuthToken}`
|
||||
},
|
||||
body: {
|
||||
profileId,
|
||||
certificateRequest: {} // Empty certificate request
|
||||
}
|
||||
});
|
||||
|
||||
expect(res.statusCode).toBe(400);
|
||||
});
|
||||
});
|
||||
|
||||
describe("Authentication", () => {
|
||||
test("Should require authentication", async () => {
|
||||
const res = await testServer.inject({
|
||||
method: "POST",
|
||||
url: "/api/v3/certificates/issue-certificate",
|
||||
body: {
|
||||
profileId,
|
||||
certificateRequest: {
|
||||
commonName: "test.example.com",
|
||||
validity: {
|
||||
ttl: "24h"
|
||||
}
|
||||
}
|
||||
}
|
||||
});
|
||||
|
||||
expect(res.statusCode).toBe(401);
|
||||
});
|
||||
|
||||
test("Should reject invalid token", async () => {
|
||||
const res = await testServer.inject({
|
||||
method: "POST",
|
||||
url: "/api/v3/certificates/issue-certificate",
|
||||
headers: {
|
||||
authorization: "Bearer invalid-token"
|
||||
},
|
||||
body: {
|
||||
profileId,
|
||||
certificateRequest: {
|
||||
commonName: "test.example.com",
|
||||
validity: {
|
||||
ttl: "24h"
|
||||
}
|
||||
}
|
||||
}
|
||||
});
|
||||
|
||||
expect(res.statusCode).toBe(401);
|
||||
});
|
||||
|
||||
test("Should require authentication for CSR signing", async () => {
|
||||
const res = await testServer.inject({
|
||||
method: "POST",
|
||||
url: "/api/v3/certificates/sign-certificate",
|
||||
body: {
|
||||
profileId,
|
||||
csr: "mock-csr",
|
||||
validity: {
|
||||
ttl: "24h"
|
||||
}
|
||||
}
|
||||
});
|
||||
|
||||
expect(res.statusCode).toBe(401);
|
||||
});
|
||||
|
||||
test("Should require authentication for certificate ordering", async () => {
|
||||
const res = await testServer.inject({
|
||||
method: "POST",
|
||||
url: "/api/v3/certificates/order-certificate",
|
||||
body: {
|
||||
profileId,
|
||||
certificateOrder: {
|
||||
identifiers: [
|
||||
{
|
||||
type: "dns",
|
||||
value: "test.example.com"
|
||||
}
|
||||
],
|
||||
validity: {
|
||||
ttl: "24h"
|
||||
}
|
||||
}
|
||||
}
|
||||
});
|
||||
|
||||
expect(res.statusCode).toBe(401);
|
||||
});
|
||||
});
|
||||
|
||||
describe("Profile-based Certificate Management", () => {
|
||||
test("Should create certificates with profile reference", async () => {
|
||||
const res = await testServer.inject({
|
||||
method: "POST",
|
||||
url: "/api/v3/certificates/issue-certificate",
|
||||
headers: {
|
||||
authorization: `Bearer ${jwtAuthToken}`
|
||||
},
|
||||
body: {
|
||||
profileId,
|
||||
certificateRequest: {
|
||||
commonName: "profile-test.example.com",
|
||||
validity: {
|
||||
ttl: "24h"
|
||||
},
|
||||
keyUsages: ["digitalSignature"],
|
||||
extendedKeyUsages: ["serverAuth"]
|
||||
}
|
||||
}
|
||||
});
|
||||
|
||||
expect(res.statusCode).toBe(200);
|
||||
const payload = JSON.parse(res.payload);
|
||||
|
||||
// Verify that the certificate was created successfully
|
||||
expect(payload).toHaveProperty("certificateId");
|
||||
expect(typeof payload.certificateId).toBe("string");
|
||||
expect(payload.certificateId.length).toBeGreaterThan(0);
|
||||
|
||||
// Verify all required fields are present
|
||||
expect(payload).toHaveProperty("certificate");
|
||||
expect(payload).toHaveProperty("certificateChain");
|
||||
expect(payload).toHaveProperty("privateKey");
|
||||
expect(payload).toHaveProperty("serialNumber");
|
||||
expect(payload).toHaveProperty("issuingCaCertificate");
|
||||
});
|
||||
|
||||
test("Should validate using template policy without template dependency", async () => {
|
||||
const res = await testServer.inject({
|
||||
method: "POST",
|
||||
url: "/api/v3/certificates/issue-certificate",
|
||||
headers: {
|
||||
authorization: `Bearer ${jwtAuthToken}`
|
||||
},
|
||||
body: {
|
||||
profileId,
|
||||
certificateRequest: {
|
||||
commonName: "policy-test.example.com",
|
||||
validity: {
|
||||
ttl: "24h"
|
||||
},
|
||||
// Include required key usages as defined in template
|
||||
keyUsages: ["digitalSignature"],
|
||||
extendedKeyUsages: ["serverAuth"],
|
||||
// Test optional attributes
|
||||
organization: "Policy Test Org",
|
||||
country: "US"
|
||||
}
|
||||
}
|
||||
});
|
||||
|
||||
expect(res.statusCode).toBe(200);
|
||||
const payload = JSON.parse(res.payload);
|
||||
expect(payload).toHaveProperty("certificate");
|
||||
expect(payload).toHaveProperty("certificateId");
|
||||
});
|
||||
|
||||
test("Should handle profile permissions correctly", async () => {
|
||||
const res = await testServer.inject({
|
||||
method: "POST",
|
||||
url: "/api/v3/certificates/issue-certificate",
|
||||
headers: {
|
||||
authorization: `Bearer ${jwtAuthToken}`
|
||||
},
|
||||
body: {
|
||||
profileId,
|
||||
certificateRequest: {
|
||||
commonName: "permission-test.example.com",
|
||||
validity: {
|
||||
ttl: "24h"
|
||||
},
|
||||
keyUsages: ["digitalSignature"],
|
||||
extendedKeyUsages: ["serverAuth"]
|
||||
}
|
||||
}
|
||||
});
|
||||
|
||||
expect(res.statusCode).toBe(200);
|
||||
const payload = JSON.parse(res.payload);
|
||||
expect(payload).toHaveProperty("certificateId");
|
||||
});
|
||||
});
|
||||
});
|
||||
Reference in New Issue
Block a user