diff --git a/backend/e2e-test/routes/est/certificate-est.spec.ts b/backend/e2e-test/routes/est/certificate-est.spec.ts deleted file mode 100644 index 58e7a1151..000000000 --- a/backend/e2e-test/routes/est/certificate-est.spec.ts +++ /dev/null @@ -1,428 +0,0 @@ -import { seedData1 } from "@app/db/seed-data"; - -describe("Certificate EST Router", () => { - let projectId: string; - let certificateAuthorityId: string; - let templateId: string; - let profileId: string; - let estPassphrase: string; - - beforeAll(async () => { - projectId = seedData1.project.id; - estPassphrase = "test-est-passphrase"; - - // Create a test certificate authority first - const caRes = await testServer.inject({ - method: "POST", - url: "/api/v1/pki/ca", - headers: { - authorization: `Bearer ${jwtAuthToken}` - }, - body: { - projectSlug: seedData1.project.slug, - type: "root", - friendlyName: "Test Root CA for EST", - organization: "Test Org", - ou: "Test OU", - country: "US", - province: "CA", - locality: "San Francisco", - commonName: "Test Root CA for EST", - ttl: "8760h" - } - }); - expect(caRes.statusCode).toBe(200); - const caPayload = JSON.parse(caRes.payload); - certificateAuthorityId = caPayload.certificateAuthority.id; - - // Create a test certificate template v2 - const templateRes = await testServer.inject({ - method: "POST", - url: "/api/v2/certificate-templates", - headers: { - authorization: `Bearer ${jwtAuthToken}` - }, - body: { - projectId, - certificateAuthorityId, - name: "Test Template for EST", - policy: { - allowedDomains: ["est.example.com", "*.est.example.com"], - allowWildcards: true, - maxTtl: "8760h" - } - } - }); - expect(templateRes.statusCode).toBe(200); - const templatePayload = JSON.parse(templateRes.payload); - templateId = templatePayload.certificateTemplate.id; - - // Create a test certificate profile with EST enrollment - const profileRes = await testServer.inject({ - method: "POST", - url: "/api/v1/certificate-profiles", - headers: { - authorization: `Bearer ${jwtAuthToken}` - }, - body: { - projectId, - certificateAuthorityId, - certificateTemplateId: templateId, - name: "Test EST Profile", - slug: "test-est-profile", - enrollmentMethod: "est", - enrollmentConfig: { - estConfig: { - passphrase: estPassphrase, - disableBootstrapCaValidation: false, - encryptedCaChain: "test-encrypted-ca-chain" - } - } - } - }); - expect(profileRes.statusCode).toBe(200); - const profilePayload = JSON.parse(profileRes.payload); - profileId = profilePayload.certificateProfile.id; - }); - - describe("GET /:identifier/cacerts", () => { - test("Should get CA certificates using profileId (no authentication required)", async () => { - const res = await testServer.inject({ - method: "GET", - url: `/api/est/${profileId}/cacerts` - }); - - expect(res.statusCode).toBe(200); - expect(res.headers["content-type"]).toContain("application/pkcs7-mime"); - expect(res.headers["content-transfer-encoding"]).toBe("base64"); - expect(typeof res.payload).toBe("string"); - }); - - test("Should get CA certificates using legacy templateId (backward compatibility)", async () => { - // First enable EST on the legacy template - const enableEstRes = await testServer.inject({ - method: "PATCH", - url: `/api/v1/pki/templates/${templateId}`, - headers: { - authorization: `Bearer ${jwtAuthToken}` - }, - body: { - estConfig: { - isEnabled: true, - passphrase: estPassphrase - } - } - }); - expect(enableEstRes.statusCode).toBe(200); - - const res = await testServer.inject({ - method: "GET", - url: `/api/est/${templateId}/cacerts` - }); - - expect(res.statusCode).toBe(200); - expect(res.headers["content-type"]).toContain("application/pkcs7-mime"); - }); - - test("Should return 404 for non-existent identifier", async () => { - const res = await testServer.inject({ - method: "GET", - url: "/api/est/non-existent-id/cacerts" - }); - - expect(res.statusCode).toBe(404); - }); - }); - - describe("Authentication for EST endpoints", () => { - test("Should require authentication for simpleenroll", async () => { - const res = await testServer.inject({ - method: "POST", - url: `/api/est/${profileId}/simpleenroll`, - body: "test-csr" - }); - - expect(res.statusCode).toBe(401); - expect(res.headers["www-authenticate"]).toBe('Basic realm="infisical"'); - }); - - test("Should require authentication for simplereenroll", async () => { - const res = await testServer.inject({ - method: "POST", - url: `/api/est/${profileId}/simplereenroll`, - body: "test-csr" - }); - - expect(res.statusCode).toBe(401); - }); - - test("Should reject invalid credentials", async () => { - const invalidAuth = Buffer.from("user:wrongpassword").toString("base64"); - - const res = await testServer.inject({ - method: "POST", - url: `/api/est/${profileId}/simpleenroll`, - headers: { - authorization: `Basic ${invalidAuth}`, - "content-type": "application/pkcs10" - }, - body: "test-csr" - }); - - expect(res.statusCode).toBe(401); - }); - - test("Should accept valid credentials", async () => { - const validAuth = Buffer.from(`user:${estPassphrase}`).toString("base64"); - - const res = await testServer.inject({ - method: "POST", - url: `/api/est/${profileId}/simpleenroll`, - headers: { - authorization: `Basic ${validAuth}`, - "content-type": "application/pkcs10" - }, - body: "test-csr" - }); - - expect(res.statusCode).not.toBe(401); - }); - }); - - describe("POST /:identifier/simpleenroll", () => { - let validAuth: string; - let testCSR: string; - - beforeAll(() => { - validAuth = Buffer.from(`user:${estPassphrase}`).toString("base64"); - // Mock CSR for testing - testCSR = `-----BEGIN CERTIFICATE REQUEST----- -MIICWjCCAUICAQAwFTETMBEGA1UEAwwKdGVzdC5jb20uY2ExXDANBgkqhkiG9w0B -AQEFAAOBiQAwgYUCgYEAyKdVQNK5Wf7V8qU2tU3hV7g4+OJ+Xz8TzL1Q2u8cQ9v -...mock CSR content... -yK5ZqN8U3QR7yB+X9vG1eI+dA== ------END CERTIFICATE REQUEST-----`; - }); - - test("Should process enrollment request with profileId", async () => { - const res = await testServer.inject({ - method: "POST", - url: `/api/est/${profileId}/simpleenroll`, - headers: { - authorization: `Basic ${validAuth}`, - "content-type": "application/pkcs10" - }, - body: testCSR - }); - - expect([200, 400]).toContain(res.statusCode); - - if (res.statusCode === 200) { - expect(res.headers["content-type"]).toContain("application/pkcs7-mime"); - expect(res.headers["content-transfer-encoding"]).toBe("base64"); - } - }); - - test("Should process enrollment request with legacy templateId", async () => { - const res = await testServer.inject({ - method: "POST", - url: `/api/est/${templateId}/simpleenroll`, - headers: { - authorization: `Basic ${validAuth}`, - "content-type": "application/pkcs10" - }, - body: testCSR - }); - - expect([200, 400]).toContain(res.statusCode); - }); - - test("Should handle PEM format CSR", async () => { - const res = await testServer.inject({ - method: "POST", - url: `/api/est/${profileId}/simpleenroll`, - headers: { - authorization: `Basic ${validAuth}`, - "content-type": "application/pkcs10" - }, - body: testCSR - }); - - expect([200, 400]).toContain(res.statusCode); - }); - - test("Should handle base64 format CSR", async () => { - const base64CSR = testCSR - .replace(/-----BEGIN CERTIFICATE REQUEST-----/, "") - .replace(/-----END CERTIFICATE REQUEST-----/, "") - .replace(/\n/g, ""); - - const res = await testServer.inject({ - method: "POST", - url: `/api/est/${profileId}/simpleenroll`, - headers: { - authorization: `Basic ${validAuth}`, - "content-type": "application/pkcs10" - }, - body: base64CSR - }); - - expect([200, 400]).toContain(res.statusCode); - }); - - test("Should fail with empty CSR", async () => { - const res = await testServer.inject({ - method: "POST", - url: `/api/est/${profileId}/simpleenroll`, - headers: { - authorization: `Basic ${validAuth}`, - "content-type": "application/pkcs10" - }, - body: "" - }); - - expect(res.statusCode).toBe(400); - }); - }); - - describe("POST /:identifier/simplereenroll", () => { - let validAuth: string; - let testCSR: string; - - beforeAll(() => { - validAuth = Buffer.from(`user:${estPassphrase}`).toString("base64"); - testCSR = `-----BEGIN CERTIFICATE REQUEST----- -MIICWjCCAUICAQAwFTETMBEGA1UEAwwKdGVzdC5jb20uY2ExXDANBgkqhkiG9w0B -AQEFAAOBiQAwgYUCgYEAyKdVQNK5Wf7V8qU2tU3hV7g4+OJ+Xz8TzL1Q2u8cQ9v -...mock CSR content... -yK5ZqN8U3QR7yB+X9vG1eI+dA== ------END CERTIFICATE REQUEST-----`; - }); - - test("Should process re-enrollment request with profileId", async () => { - const res = await testServer.inject({ - method: "POST", - url: `/api/est/${profileId}/simplereenroll`, - headers: { - authorization: `Basic ${validAuth}`, - "content-type": "application/pkcs10" - }, - body: testCSR - }); - - expect([200, 400]).toContain(res.statusCode); - - if (res.statusCode === 200) { - expect(res.headers["content-type"]).toContain("application/pkcs7-mime"); - expect(res.headers["content-transfer-encoding"]).toBe("base64"); - } - }); - - test("Should process re-enrollment request with legacy templateId", async () => { - const res = await testServer.inject({ - method: "POST", - url: `/api/est/${templateId}/simplereenroll`, - headers: { - authorization: `Basic ${validAuth}`, - "content-type": "application/pkcs10" - }, - body: testCSR - }); - - expect([200, 400]).toContain(res.statusCode); - }); - }); - - describe("EST Configuration Validation", () => { - test("Should fail when EST is disabled on profile", async () => { - // Create a profile with EST disabled - const disabledProfileRes = await testServer.inject({ - method: "POST", - url: "/api/v1/certificate-profiles", - headers: { - authorization: `Bearer ${jwtAuthToken}` - }, - body: { - projectId, - certificateAuthorityId, - certificateTemplateId: templateId, - name: "Disabled EST Profile", - slug: "disabled-est-profile", - enrollmentMethod: "api" // Not EST - } - }); - expect(disabledProfileRes.statusCode).toBe(200); - const disabledProfile = JSON.parse(disabledProfileRes.payload); - - const validAuth = Buffer.from(`user:${estPassphrase}`).toString("base64"); - - const res = await testServer.inject({ - method: "POST", - url: `/api/est/${disabledProfile.certificateProfile.id}/simpleenroll`, - headers: { - authorization: `Basic ${validAuth}`, - "content-type": "application/pkcs10" - }, - body: "test-csr" - }); - - expect(res.statusCode).toBe(400); - }); - - test("Should handle missing authorization header gracefully", async () => { - const res = await testServer.inject({ - method: "POST", - url: `/api/est/${profileId}/simpleenroll`, - body: "test-csr" - }); - - expect(res.statusCode).toBe(401); - expect(res.headers["www-authenticate"]).toBeDefined(); - }); - }); - - describe("Content Type Handling", () => { - test("Should handle different content types for CSR", async () => { - const validAuth = Buffer.from(`user:${estPassphrase}`).toString("base64"); - - const res = await testServer.inject({ - method: "POST", - url: `/api/est/${profileId}/simpleenroll`, - headers: { - authorization: `Basic ${validAuth}`, - "content-type": "application/pkcs10" - }, - body: "test-csr-content" - }); - - // Should not fail due to content type - expect(res.statusCode).not.toBe(415); - }); - }); - - describe("Profile vs Template Identifier Detection", () => { - test("Should correctly identify UUID as profileId", async () => { - const isUUIDPattern = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i; - expect(isUUIDPattern.test(profileId)).toBe(true); - - const res = await testServer.inject({ - method: "GET", - url: `/api/est/${profileId}/cacerts` - }); - - expect(res.statusCode).toBe(200); - }); - - test("Should correctly identify non-UUID as legacy templateId", async () => { - const isUUIDPattern = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i; - expect(isUUIDPattern.test(templateId)).toBe(false); - - const res = await testServer.inject({ - method: "GET", - url: `/api/est/${templateId}/cacerts` - }); - - expect(res.statusCode).toBe(200); - }); - }); -}); diff --git a/backend/e2e-test/routes/v1/certificate-profiles.spec.ts b/backend/e2e-test/routes/v1/certificate-profiles.spec.ts deleted file mode 100644 index 23d760eb5..000000000 --- a/backend/e2e-test/routes/v1/certificate-profiles.spec.ts +++ /dev/null @@ -1,391 +0,0 @@ -import { seedData1 } from "@app/db/seed-data"; - -describe("Certificate Profiles Router", () => { - let projectId: string; - let certificateAuthorityId: string; - let templateId: string; - let profileId: string; - - beforeAll(async () => { - projectId = seedData1.project.id; - - // Create a test certificate authority first - const caRes = await testServer.inject({ - method: "POST", - url: "/api/v1/pki/ca", - headers: { - authorization: `Bearer ${jwtAuthToken}` - }, - body: { - projectSlug: seedData1.project.slug, - type: "root", - friendlyName: "Test Root CA", - organization: "Test Org", - ou: "Test OU", - country: "US", - province: "CA", - locality: "San Francisco", - commonName: "Test Root CA", - ttl: "8760h" - } - }); - expect(caRes.statusCode).toBe(200); - const caPayload = JSON.parse(caRes.payload); - certificateAuthorityId = caPayload.certificateAuthority.id; - - // Create a test certificate template v2 - const templateRes = await testServer.inject({ - method: "POST", - url: "/api/v2/certificate-templates", - headers: { - authorization: `Bearer ${jwtAuthToken}` - }, - body: { - projectId, - certificateAuthorityId, - name: "Test Template for Profile", - policy: { - allowedDomains: ["example.com"], - maxTtl: "8760h" - } - } - }); - expect(templateRes.statusCode).toBe(200); - const templatePayload = JSON.parse(templateRes.payload); - templateId = templatePayload.certificateTemplate.id; - }); - - describe("POST /v1/certificate-profiles", () => { - test("Should create a certificate profile", async () => { - const res = await testServer.inject({ - method: "POST", - url: "/api/v1/certificate-profiles", - headers: { - authorization: `Bearer ${jwtAuthToken}` - }, - body: { - projectId, - certificateAuthorityId, - certificateTemplateId: templateId, - name: "Test Profile", - slug: "test-profile", - description: "A test certificate profile", - enrollmentMethod: "api", - enrollmentConfig: { - apiConfig: { - autoRenew: true, - autoRenewDays: 30 - } - } - } - }); - - expect(res.statusCode).toBe(200); - const payload = JSON.parse(res.payload); - expect(payload).toHaveProperty("certificateProfile"); - expect(payload.certificateProfile).toHaveProperty("id"); - expect(payload.certificateProfile.name).toBe("Test Profile"); - expect(payload.certificateProfile.slug).toBe("test-profile"); - expect(payload.certificateProfile.projectId).toBe(projectId); - expect(payload.certificateProfile.certificateAuthorityId).toBe(certificateAuthorityId); - expect(payload.certificateProfile.certificateTemplateId).toBe(templateId); - - profileId = payload.certificateProfile.id; - }); - - test("Should create profile with EST enrollment", async () => { - const res = await testServer.inject({ - method: "POST", - url: "/api/v1/certificate-profiles", - headers: { - authorization: `Bearer ${jwtAuthToken}` - }, - body: { - projectId, - certificateAuthorityId, - certificateTemplateId: templateId, - name: "EST Profile", - slug: "est-profile", - enrollmentMethod: "est", - enrollmentConfig: { - estConfig: { - passphrase: "test-passphrase", - disableBootstrapCaValidation: false, - encryptedCaChain: "encrypted-ca-chain-data" - } - } - } - }); - - expect(res.statusCode).toBe(200); - const payload = JSON.parse(res.payload); - expect(payload.certificateProfile.enrollmentMethod).toBe("est"); - }); - - test("Should fail to create profile with invalid project", async () => { - const res = await testServer.inject({ - method: "POST", - url: "/api/v1/certificate-profiles", - headers: { - authorization: `Bearer ${jwtAuthToken}` - }, - body: { - projectId: "invalid-project-id", - certificateAuthorityId, - certificateTemplateId: templateId, - name: "Invalid Profile", - slug: "invalid-profile" - } - }); - - expect(res.statusCode).toBe(400); - }); - - test("Should fail to create profile with duplicate slug", async () => { - const res = await testServer.inject({ - method: "POST", - url: "/api/v1/certificate-profiles", - headers: { - authorization: `Bearer ${jwtAuthToken}` - }, - body: { - projectId, - certificateAuthorityId, - certificateTemplateId: templateId, - name: "Duplicate Profile", - slug: "test-profile" // Same slug as first profile - } - }); - - expect(res.statusCode).toBe(400); - }); - }); - - describe("GET /v1/certificate-profiles", () => { - test("Should list certificate profiles", async () => { - const res = await testServer.inject({ - method: "GET", - url: `/api/v1/certificate-profiles?projectId=${projectId}`, - headers: { - authorization: `Bearer ${jwtAuthToken}` - } - }); - - expect(res.statusCode).toBe(200); - const payload = JSON.parse(res.payload); - expect(payload).toHaveProperty("certificateProfiles"); - expect(payload).toHaveProperty("totalCount"); - expect(Array.isArray(payload.certificateProfiles)).toBe(true); - expect(payload.totalCount).toBeGreaterThan(0); - }); - - test("Should support pagination and search", async () => { - const res = await testServer.inject({ - method: "GET", - url: `/api/v1/certificate-profiles?projectId=${projectId}&offset=0&limit=1&search=Test`, - headers: { - authorization: `Bearer ${jwtAuthToken}` - } - }); - - expect(res.statusCode).toBe(200); - const payload = JSON.parse(res.payload); - expect(payload.certificateProfiles.length).toBeLessThanOrEqual(1); - }); - }); - - describe("GET /v1/certificate-profiles/:id", () => { - test("Should get certificate profile by ID with configs", async () => { - const res = await testServer.inject({ - method: "GET", - url: `/api/v1/certificate-profiles/${profileId}`, - headers: { - authorization: `Bearer ${jwtAuthToken}` - } - }); - - expect(res.statusCode).toBe(200); - const payload = JSON.parse(res.payload); - expect(payload).toHaveProperty("certificateProfile"); - expect(payload.certificateProfile.id).toBe(profileId); - expect(payload.certificateProfile.name).toBe("Test Profile"); - expect(payload.certificateProfile).toHaveProperty("certificateAuthority"); - expect(payload.certificateProfile).toHaveProperty("certificateTemplate"); - expect(payload.certificateProfile).toHaveProperty("apiConfig"); - }); - - test("Should return 404 for non-existent profile", async () => { - const res = await testServer.inject({ - method: "GET", - url: "/api/v1/certificate-profiles/non-existent-id", - headers: { - authorization: `Bearer ${jwtAuthToken}` - } - }); - - expect(res.statusCode).toBe(404); - }); - }); - - describe("GET /v1/certificate-profiles/slug/:slug", () => { - test("Should get certificate profile by slug", async () => { - const res = await testServer.inject({ - method: "GET", - url: `/api/v1/certificate-profiles/slug/test-profile?projectId=${projectId}`, - headers: { - authorization: `Bearer ${jwtAuthToken}` - } - }); - - expect(res.statusCode).toBe(200); - const payload = JSON.parse(res.payload); - expect(payload).toHaveProperty("certificateProfile"); - expect(payload.certificateProfile.slug).toBe("test-profile"); - }); - - test("Should return 404 for non-existent slug", async () => { - const res = await testServer.inject({ - method: "GET", - url: `/api/v1/certificate-profiles/slug/non-existent?projectId=${projectId}`, - headers: { - authorization: `Bearer ${jwtAuthToken}` - } - }); - - expect(res.statusCode).toBe(404); - }); - }); - - describe("PATCH /v1/certificate-profiles/:id", () => { - test("Should update certificate profile", async () => { - const res = await testServer.inject({ - method: "PATCH", - url: `/api/v1/certificate-profiles/${profileId}`, - headers: { - authorization: `Bearer ${jwtAuthToken}` - }, - body: { - name: "Updated Test Profile", - description: "Updated description", - enrollmentConfig: { - apiConfig: { - autoRenew: false, - autoRenewDays: 60 - } - } - } - }); - - expect(res.statusCode).toBe(200); - const payload = JSON.parse(res.payload); - expect(payload.certificateProfile.name).toBe("Updated Test Profile"); - expect(payload.certificateProfile.description).toBe("Updated description"); - }); - }); - - describe("GET /v1/certificate-profiles/:id/certificates", () => { - test("Should list certificates for profile", async () => { - const res = await testServer.inject({ - method: "GET", - url: `/api/v1/certificate-profiles/${profileId}/certificates`, - headers: { - authorization: `Bearer ${jwtAuthToken}` - } - }); - - expect(res.statusCode).toBe(200); - const payload = JSON.parse(res.payload); - expect(payload).toHaveProperty("certificates"); - expect(Array.isArray(payload.certificates)).toBe(true); - }); - - test("Should support filtering and pagination", async () => { - const res = await testServer.inject({ - method: "GET", - url: `/api/v1/certificate-profiles/${profileId}/certificates?status=active&offset=0&limit=10`, - headers: { - authorization: `Bearer ${jwtAuthToken}` - } - }); - - expect(res.statusCode).toBe(200); - const payload = JSON.parse(res.payload); - expect(payload.certificates.length).toBeLessThanOrEqual(10); - }); - }); - - describe("GET /v1/certificate-profiles/:id/metrics", () => { - test("Should get profile metrics", async () => { - const res = await testServer.inject({ - method: "GET", - url: `/api/v1/certificate-profiles/${profileId}/metrics?expiringDays=30`, - headers: { - authorization: `Bearer ${jwtAuthToken}` - } - }); - - expect(res.statusCode).toBe(200); - const payload = JSON.parse(res.payload); - expect(payload).toHaveProperty("metrics"); - expect(payload.metrics).toHaveProperty("profileId"); - expect(payload.metrics).toHaveProperty("totalCertificates"); - expect(payload.metrics).toHaveProperty("activeCertificates"); - expect(payload.metrics).toHaveProperty("expiredCertificates"); - expect(payload.metrics).toHaveProperty("expiringCertificates"); - expect(payload.metrics).toHaveProperty("revokedCertificates"); - expect(payload.metrics.profileId).toBe(profileId); - }); - }); - - describe("DELETE /v1/certificate-profiles/:id", () => { - test("Should delete certificate profile", async () => { - const res = await testServer.inject({ - method: "DELETE", - url: `/api/v1/certificate-profiles/${profileId}`, - headers: { - authorization: `Bearer ${jwtAuthToken}` - } - }); - - expect(res.statusCode).toBe(200); - const payload = JSON.parse(res.payload); - expect(payload).toHaveProperty("certificateProfile"); - expect(payload.certificateProfile.id).toBe(profileId); - }); - - test("Should return 404 when deleting non-existent profile", async () => { - const res = await testServer.inject({ - method: "DELETE", - url: `/api/v1/certificate-profiles/${profileId}`, - headers: { - authorization: `Bearer ${jwtAuthToken}` - } - }); - - expect(res.statusCode).toBe(404); - }); - }); - - describe("Authentication", () => { - test("Should require authentication", async () => { - const res = await testServer.inject({ - method: "GET", - url: `/api/v1/certificate-profiles?projectId=${projectId}` - }); - - expect(res.statusCode).toBe(401); - }); - - test("Should reject invalid token", async () => { - const res = await testServer.inject({ - method: "GET", - url: `/api/v1/certificate-profiles?projectId=${projectId}`, - headers: { - authorization: "Bearer invalid-token" - } - }); - - expect(res.statusCode).toBe(401); - }); - }); -}); diff --git a/backend/e2e-test/routes/v2/certificate-templates-v2.spec.ts b/backend/e2e-test/routes/v2/certificate-templates-v2.spec.ts deleted file mode 100644 index 94b583829..000000000 --- a/backend/e2e-test/routes/v2/certificate-templates-v2.spec.ts +++ /dev/null @@ -1,292 +0,0 @@ -import { seedData1 } from "@app/db/seed-data"; - -describe("Certificate Templates V2 Router", () => { - let projectId: string; - let certificateAuthorityId: string; - let templateId: string; - - beforeAll(async () => { - projectId = seedData1.project.id; - - // Create a test certificate authority first - const caRes = await testServer.inject({ - method: "POST", - url: "/api/v1/pki/ca", - headers: { - authorization: `Bearer ${jwtAuthToken}` - }, - body: { - projectSlug: seedData1.project.slug, - type: "root", - friendlyName: "Test Root CA", - organization: "Test Org", - ou: "Test OU", - country: "US", - province: "CA", - locality: "San Francisco", - commonName: "Test Root CA", - ttl: "8760h" - } - }); - expect(caRes.statusCode).toBe(200); - const caPayload = JSON.parse(caRes.payload); - certificateAuthorityId = caPayload.certificateAuthority.id; - }); - - describe("POST /v2/certificate-templates", () => { - test("Should create a certificate template v2", async () => { - const res = await testServer.inject({ - method: "POST", - url: "/api/v2/certificate-templates", - headers: { - authorization: `Bearer ${jwtAuthToken}` - }, - body: { - projectId, - certificateAuthorityId, - name: "Test Template V2", - description: "A test certificate template v2", - policy: { - allowedDomains: ["example.com", "*.example.com"], - allowWildcards: true, - allowAnyName: false, - allowIpSans: false, - allowSubdomains: true, - maxTtl: "8760h", - keyUsages: ["digital_signature", "key_agreement"], - extendedKeyUsages: ["server_auth", "client_auth"], - organizationPolicy: { - allowedOrganizations: ["Test Org"], - enforceOrganization: true - }, - subjectPolicy: { - allowedCountries: ["US", "CA"], - allowedProvinces: ["CA", "NY"], - allowedLocalities: ["San Francisco", "New York"], - enforceSubject: false - } - } - } - }); - - expect(res.statusCode).toBe(200); - const payload = JSON.parse(res.payload); - expect(payload).toHaveProperty("certificateTemplate"); - expect(payload.certificateTemplate).toHaveProperty("id"); - expect(payload.certificateTemplate.name).toBe("Test Template V2"); - expect(payload.certificateTemplate.projectId).toBe(projectId); - expect(payload.certificateTemplate.certificateAuthorityId).toBe(certificateAuthorityId); - - templateId = payload.certificateTemplate.id; - }); - - test("Should fail to create template with invalid project", async () => { - const res = await testServer.inject({ - method: "POST", - url: "/api/v2/certificate-templates", - headers: { - authorization: `Bearer ${jwtAuthToken}` - }, - body: { - projectId: "invalid-project-id", - certificateAuthorityId, - name: "Invalid Template", - policy: {} - } - }); - - expect(res.statusCode).toBe(400); - }); - }); - - describe("GET /v2/certificate-templates", () => { - test("Should list certificate templates v2", async () => { - const res = await testServer.inject({ - method: "GET", - url: `/api/v2/certificate-templates?projectId=${projectId}`, - headers: { - authorization: `Bearer ${jwtAuthToken}` - } - }); - - expect(res.statusCode).toBe(200); - const payload = JSON.parse(res.payload); - expect(payload).toHaveProperty("certificateTemplates"); - expect(payload).toHaveProperty("totalCount"); - expect(Array.isArray(payload.certificateTemplates)).toBe(true); - expect(payload.totalCount).toBeGreaterThan(0); - }); - - test("Should support pagination", async () => { - const res = await testServer.inject({ - method: "GET", - url: `/api/v2/certificate-templates?projectId=${projectId}&offset=0&limit=1`, - headers: { - authorization: `Bearer ${jwtAuthToken}` - } - }); - - expect(res.statusCode).toBe(200); - const payload = JSON.parse(res.payload); - expect(payload.certificateTemplates.length).toBeLessThanOrEqual(1); - }); - }); - - describe("GET /v2/certificate-templates/:id", () => { - test("Should get certificate template v2 by ID", async () => { - const res = await testServer.inject({ - method: "GET", - url: `/api/v2/certificate-templates/${templateId}`, - headers: { - authorization: `Bearer ${jwtAuthToken}` - } - }); - - expect(res.statusCode).toBe(200); - const payload = JSON.parse(res.payload); - expect(payload).toHaveProperty("certificateTemplate"); - expect(payload.certificateTemplate.id).toBe(templateId); - expect(payload.certificateTemplate.name).toBe("Test Template V2"); - }); - - test("Should return 404 for non-existent template", async () => { - const res = await testServer.inject({ - method: "GET", - url: "/api/v2/certificate-templates/non-existent-id", - headers: { - authorization: `Bearer ${jwtAuthToken}` - } - }); - - expect(res.statusCode).toBe(404); - }); - }); - - describe("PATCH /v2/certificate-templates/:id", () => { - test("Should update certificate template v2", async () => { - const res = await testServer.inject({ - method: "PATCH", - url: `/api/v2/certificate-templates/${templateId}`, - headers: { - authorization: `Bearer ${jwtAuthToken}` - }, - body: { - name: "Updated Test Template V2", - description: "Updated description", - policy: { - allowedDomains: ["updated.com"], - allowWildcards: false, - maxTtl: "4380h" - } - } - }); - - expect(res.statusCode).toBe(200); - const payload = JSON.parse(res.payload); - expect(payload.certificateTemplate.name).toBe("Updated Test Template V2"); - expect(payload.certificateTemplate.description).toBe("Updated description"); - }); - }); - - describe("POST /v2/certificate-templates/:id/validate", () => { - test("Should validate certificate request against template policy", async () => { - const res = await testServer.inject({ - method: "POST", - url: `/api/v2/certificate-templates/${templateId}/validate`, - headers: { - authorization: `Bearer ${jwtAuthToken}` - }, - body: { - request: { - commonName: "test.updated.com", - ttl: "24h", - keyUsages: ["digital_signature"], - extendedKeyUsages: ["server_auth"] - } - } - }); - - expect(res.statusCode).toBe(200); - const payload = JSON.parse(res.payload); - expect(payload).toHaveProperty("valid"); - expect(typeof payload.valid).toBe("boolean"); - if (!payload.valid) { - expect(payload).toHaveProperty("errors"); - expect(Array.isArray(payload.errors)).toBe(true); - } - }); - - test("Should reject invalid certificate request", async () => { - const res = await testServer.inject({ - method: "POST", - url: `/api/v2/certificate-templates/${templateId}/validate`, - headers: { - authorization: `Bearer ${jwtAuthToken}` - }, - body: { - request: { - commonName: "invalid.domain.com", // Not in allowed domains - ttl: "24h" - } - } - }); - - expect(res.statusCode).toBe(200); - const payload = JSON.parse(res.payload); - expect(payload.valid).toBe(false); - expect(payload.errors).toBeDefined(); - }); - }); - - describe("DELETE /v2/certificate-templates/:id", () => { - test("Should delete certificate template v2", async () => { - const res = await testServer.inject({ - method: "DELETE", - url: `/api/v2/certificate-templates/${templateId}`, - headers: { - authorization: `Bearer ${jwtAuthToken}` - } - }); - - expect(res.statusCode).toBe(200); - const payload = JSON.parse(res.payload); - expect(payload).toHaveProperty("certificateTemplate"); - expect(payload.certificateTemplate.id).toBe(templateId); - }); - - test("Should return 404 when deleting non-existent template", async () => { - const res = await testServer.inject({ - method: "DELETE", - url: `/api/v2/certificate-templates/${templateId}`, - headers: { - authorization: `Bearer ${jwtAuthToken}` - } - }); - - expect(res.statusCode).toBe(404); - }); - }); - - describe("Authentication", () => { - test("Should require authentication", async () => { - const res = await testServer.inject({ - method: "GET", - url: `/api/v2/certificate-templates?projectId=${projectId}` - }); - - expect(res.statusCode).toBe(401); - }); - - test("Should reject invalid token", async () => { - const res = await testServer.inject({ - method: "GET", - url: `/api/v2/certificate-templates?projectId=${projectId}`, - headers: { - authorization: "Bearer invalid-token" - } - }); - - expect(res.statusCode).toBe(401); - }); - }); -}); diff --git a/backend/e2e-test/routes/v3/certificates.spec.ts b/backend/e2e-test/routes/v3/certificates.spec.ts deleted file mode 100644 index b75e7c935..000000000 --- a/backend/e2e-test/routes/v3/certificates.spec.ts +++ /dev/null @@ -1,855 +0,0 @@ -import { seedData1 } from "@app/db/seed-data"; - -describe("Certificates V3 Router", () => { - let projectId: string; - let certificateAuthorityId: string; - let templateId: string; - let profileId: string; - - beforeAll(async () => { - projectId = seedData1.project.id; - - // Create a test certificate authority first - const caRes = await testServer.inject({ - method: "POST", - url: "/api/v1/pki/ca", - headers: { - authorization: `Bearer ${jwtAuthToken}` - }, - body: { - projectSlug: seedData1.project.slug, - type: "root", - friendlyName: "Test Root CA", - organization: "Test Org", - ou: "Test OU", - country: "US", - province: "CA", - locality: "San Francisco", - commonName: "Test Root CA", - ttl: "8760h" - } - }); - expect(caRes.statusCode).toBe(200); - const caPayload = JSON.parse(caRes.payload); - certificateAuthorityId = caPayload.certificateAuthority.id; - - // Create a test certificate template v2 with proper V2 structure - const templateRes = await testServer.inject({ - method: "POST", - url: "/api/v2/certificate-templates", - headers: { - authorization: `Bearer ${jwtAuthToken}` - }, - body: { - projectId, - name: "Test Template for V3", - description: "Template for testing V3 certificate endpoints", - attributes: [ - { - type: "common_name", - include: "optional", - value: ["*.example.com", "example.com"] - }, - { - type: "organization_name", - include: "optional" - }, - { - type: "country", - include: "optional", - value: ["US", "CA"] - } - ], - keyUsages: { - requiredUsages: { - all: ["digital_signature"] - }, - optionalUsages: { - all: ["key_encipherment", "key_agreement"] - } - }, - extendedKeyUsages: { - requiredUsages: { - all: ["server_auth"] - }, - optionalUsages: { - all: ["client_auth"] - } - }, - subjectAlternativeNames: [ - { - type: "dns_name", - include: "optional", - value: ["*.example.com", "example.com"] - } - ], - validity: { - maxDuration: { - value: 365, - unit: "days" - } - } - } - }); - expect(templateRes.statusCode).toBe(200); - const templatePayload = JSON.parse(templateRes.payload); - templateId = templatePayload.certificateTemplate.id; - - // Create a test certificate profile - const profileRes = await testServer.inject({ - method: "POST", - url: "/api/v1/certificate-profiles", - headers: { - authorization: `Bearer ${jwtAuthToken}` - }, - body: { - projectId, - certificateAuthorityId, - certificateTemplateId: templateId, - name: "Test Profile for V3", - slug: "test-profile-v3", - enrollmentMethod: "api", - enrollmentConfig: { - apiConfig: { - autoRenew: false - } - } - } - }); - expect(profileRes.statusCode).toBe(200); - const profilePayload = JSON.parse(profileRes.payload); - profileId = profilePayload.certificateProfile.id; - }); - - describe("POST /v3/certificates/issue-certificate", () => { - test("Should issue a certificate using profileId", async () => { - const res = await testServer.inject({ - method: "POST", - url: "/api/v3/certificates/issue-certificate", - headers: { - authorization: `Bearer ${jwtAuthToken}` - }, - body: { - profileId, - certificateRequest: { - commonName: "test.example.com", - organization: "Test Org", - organizationUnit: "Test OU", - locality: "San Francisco", - state: "CA", - country: "US", - email: "test@example.com", - keyUsages: ["digitalSignature"], - extendedKeyUsages: ["serverAuth"], - subjectAlternativeNames: [ - { - type: "dns_name", - value: "www.example.com" - }, - { - type: "dns_name", - value: "api.example.com" - } - ], - validity: { - ttl: "24h" - } - } - } - }); - - expect(res.statusCode).toBe(200); - const payload = JSON.parse(res.payload); - expect(payload).toHaveProperty("certificate"); - expect(payload).toHaveProperty("issuingCaCertificate"); - expect(payload).toHaveProperty("certificateChain"); - expect(payload).toHaveProperty("privateKey"); - expect(payload).toHaveProperty("serialNumber"); - expect(payload).toHaveProperty("certificateId"); - - // Verify certificate fields - expect(typeof payload.certificate).toBe("string"); - expect(payload.certificate.includes("BEGIN CERTIFICATE")).toBe(true); - expect(typeof payload.privateKey).toBe("string"); - expect(payload.privateKey.includes("BEGIN PRIVATE KEY")).toBe(true); - }); - - test("Should fail with invalid profileId", async () => { - const res = await testServer.inject({ - method: "POST", - url: "/api/v3/certificates/issue-certificate", - headers: { - authorization: `Bearer ${jwtAuthToken}` - }, - body: { - profileId: "invalid-profile-id", - certificateRequest: { - commonName: "test.example.com", - validity: { - ttl: "24h" - } - } - } - }); - - expect(res.statusCode).toBe(404); - }); - - test("Should fail with domain not allowed by policy", async () => { - const res = await testServer.inject({ - method: "POST", - url: "/api/v3/certificates/issue-certificate", - headers: { - authorization: `Bearer ${jwtAuthToken}` - }, - body: { - profileId, - certificateRequest: { - commonName: "test.notallowed.com", - validity: { - ttl: "24h" - } - } - } - }); - - expect(res.statusCode).toBe(400); - }); - - test("Should fail with invalid TTL", async () => { - const res = await testServer.inject({ - method: "POST", - url: "/api/v3/certificates/issue-certificate", - headers: { - authorization: `Bearer ${jwtAuthToken}` - }, - body: { - profileId, - certificateRequest: { - commonName: "test.example.com", - validity: { - ttl: "invalid-ttl" - } - } - } - }); - - expect(res.statusCode).toBe(400); - }); - - test("Should handle wildcard certificates", async () => { - const res = await testServer.inject({ - method: "POST", - url: "/api/v3/certificates/issue-certificate", - headers: { - authorization: `Bearer ${jwtAuthToken}` - }, - body: { - profileId, - certificateRequest: { - commonName: "*.example.com", - validity: { - ttl: "24h" - } - } - } - }); - - expect(res.statusCode).toBe(200); - const payload = JSON.parse(res.payload); - expect(payload).toHaveProperty("certificate"); - }); - - test("Should validate certificate with profile policy", async () => { - const res = await testServer.inject({ - method: "POST", - url: "/api/v3/certificates/issue-certificate", - headers: { - authorization: `Bearer ${jwtAuthToken}` - }, - body: { - profileId, - certificateRequest: { - commonName: "app.example.com", - keyUsages: ["digitalSignature"], // Required by template - extendedKeyUsages: ["serverAuth"], // Required by template - validity: { - ttl: "24h" - } - } - } - }); - - expect(res.statusCode).toBe(200); - const payload = JSON.parse(res.payload); - expect(payload).toHaveProperty("certificate"); - expect(payload).toHaveProperty("certificateId"); - - // Verify the certificate was created with profile reference - expect(typeof payload.certificateId).toBe("string"); - expect(payload.certificateId.length).toBeGreaterThan(0); - }); - }); - - describe("POST /v3/certificates/sign-certificate", () => { - let testCSR: string; - - beforeAll(() => { - // Mock CSR for testing - in real tests you'd generate a proper CSR - testCSR = `-----BEGIN CERTIFICATE REQUEST----- -MIICWjCCAUICAQAwFTETMBEGA1UEAwwKdGVzdC5jb20uY2ExXDANBgkqhkiG9w0B -AQEFAAOBiQAwgYUCgYEAyKdVQNK5Wf7V8qU2tU3hV7g4+OJ+Xz8TzL1Q2u8cQ9v -...mock CSR content... -yK5ZqN8U3QR7yB+X9vG1eI+dA== ------END CERTIFICATE REQUEST-----`; - }); - - test("Should sign a CSR using profileId", async () => { - const res = await testServer.inject({ - method: "POST", - url: "/api/v3/certificates/sign-certificate", - headers: { - authorization: `Bearer ${jwtAuthToken}` - }, - body: { - profileId, - csr: testCSR, - validity: { - ttl: "24h" - } - } - }); - - expect([200, 400]).toContain(res.statusCode); - - if (res.statusCode === 200) { - const payload = JSON.parse(res.payload); - expect(payload).toHaveProperty("certificate"); - expect(payload).toHaveProperty("issuingCaCertificate"); - expect(payload).toHaveProperty("certificateChain"); - expect(payload).toHaveProperty("serialNumber"); - expect(payload).toHaveProperty("certificateId"); - - // Verify the certificate was created with profile reference - expect(typeof payload.certificateId).toBe("string"); - expect(payload.certificateId.length).toBeGreaterThan(0); - } - }); - - test("Should fail with invalid CSR", async () => { - const res = await testServer.inject({ - method: "POST", - url: "/api/v3/certificates/sign-certificate", - headers: { - authorization: `Bearer ${jwtAuthToken}` - }, - body: { - profileId, - csr: "invalid-csr", - validity: { - ttl: "24h" - } - } - }); - - expect(res.statusCode).toBe(400); - }); - - test("Should fail with empty CSR", async () => { - const res = await testServer.inject({ - method: "POST", - url: "/api/v3/certificates/sign-certificate", - headers: { - authorization: `Bearer ${jwtAuthToken}` - }, - body: { - profileId, - csr: "", - validity: { - ttl: "24h" - } - } - }); - - expect(res.statusCode).toBe(400); - }); - - test("Should fail with invalid profileId for CSR signing", async () => { - const res = await testServer.inject({ - method: "POST", - url: "/api/v3/certificates/sign-certificate", - headers: { - authorization: `Bearer ${jwtAuthToken}` - }, - body: { - profileId: "invalid-profile-id", - csr: testCSR, - validity: { - ttl: "24h" - } - } - }); - - expect(res.statusCode).toBe(404); - }); - }); - - describe("POST /v3/certificates/order-certificate", () => { - test("Should create a certificate order using profileId", async () => { - const res = await testServer.inject({ - method: "POST", - url: "/api/v3/certificates/order-certificate", - headers: { - authorization: `Bearer ${jwtAuthToken}` - }, - body: { - profileId, - certificateOrder: { - identifiers: [ - { - type: "dns", - value: "test.example.com" - }, - { - type: "dns", - value: "www.example.com" - } - ], - validity: { - ttl: "24h" - }, - commonName: "test.example.com", - keyUsages: ["digitalSignature"], - extendedKeyUsages: ["serverAuth"], - organization: "Test Org" - } - } - }); - - expect(res.statusCode).toBe(200); - const payload = JSON.parse(res.payload); - expect(payload).toHaveProperty("orderId"); - expect(payload).toHaveProperty("status"); - expect(payload).toHaveProperty("identifiers"); - expect(payload).toHaveProperty("authorizations"); - expect(payload).toHaveProperty("finalize"); - - // Verify order structure - expect(Array.isArray(payload.identifiers)).toBe(true); - expect(payload.identifiers.length).toBe(2); - expect(Array.isArray(payload.authorizations)).toBe(true); - expect(["pending", "processing", "valid", "invalid"]).toContain(payload.status); - }); - - test("Should fail with invalid identifiers", async () => { - const res = await testServer.inject({ - method: "POST", - url: "/api/v3/certificates/order-certificate", - headers: { - authorization: `Bearer ${jwtAuthToken}` - }, - body: { - profileId, - certificateOrder: { - identifiers: [], // Empty identifiers - validity: { - ttl: "24h" - } - } - } - }); - - expect(res.statusCode).toBe(400); - }); - - test("Should fail with disallowed domains", async () => { - const res = await testServer.inject({ - method: "POST", - url: "/api/v3/certificates/order-certificate", - headers: { - authorization: `Bearer ${jwtAuthToken}` - }, - body: { - profileId, - certificateOrder: { - identifiers: [ - { - type: "dns", - value: "test.notallowed.com" - } - ], - validity: { - ttl: "24h" - } - } - } - }); - - expect(res.statusCode).toBe(400); - }); - - test("Should handle IP identifiers", async () => { - const res = await testServer.inject({ - method: "POST", - url: "/api/v3/certificates/order-certificate", - headers: { - authorization: `Bearer ${jwtAuthToken}` - }, - body: { - profileId, - certificateOrder: { - identifiers: [ - { - type: "ip", - value: "192.168.1.1" - } - ], - validity: { - ttl: "24h" - } - } - } - }); - - expect([200, 400]).toContain(res.statusCode); - }); - - test("Should validate order against template policy", async () => { - const res = await testServer.inject({ - method: "POST", - url: "/api/v3/certificates/order-certificate", - headers: { - authorization: `Bearer ${jwtAuthToken}` - }, - body: { - profileId, - certificateOrder: { - identifiers: [ - { - type: "dns", - value: "api.example.com" - } - ], - validity: { - ttl: "24h" - }, - commonName: "api.example.com", - keyUsages: ["digitalSignature"], // Required by template - extendedKeyUsages: ["serverAuth"], // Required by template - organization: "Test Org" - } - } - }); - - expect(res.statusCode).toBe(200); - const payload = JSON.parse(res.payload); - expect(payload).toHaveProperty("orderId"); - expect(payload.status).toBe("valid"); - }); - - test("Should fail with invalid profileId for ordering", async () => { - const res = await testServer.inject({ - method: "POST", - url: "/api/v3/certificates/order-certificate", - headers: { - authorization: `Bearer ${jwtAuthToken}` - }, - body: { - profileId: "invalid-profile-id", - certificateOrder: { - identifiers: [ - { - type: "dns", - value: "test.example.com" - } - ], - validity: { - ttl: "24h" - } - } - } - }); - - expect(res.statusCode).toBe(404); - }); - }); - - describe("Validation and Error Handling", () => { - test("Should validate TTL format", async () => { - const res = await testServer.inject({ - method: "POST", - url: "/api/v3/certificates/issue-certificate", - headers: { - authorization: `Bearer ${jwtAuthToken}` - }, - body: { - profileId, - certificateRequest: { - commonName: "test.example.com", - validity: { - ttl: "0h" // Invalid TTL - } - } - } - }); - - expect(res.statusCode).toBe(400); - }); - - test("Should validate country code format", async () => { - const res = await testServer.inject({ - method: "POST", - url: "/api/v3/certificates/issue-certificate", - headers: { - authorization: `Bearer ${jwtAuthToken}` - }, - body: { - profileId, - certificateRequest: { - commonName: "test.example.com", - validity: { - ttl: "24h" - }, - country: "USA" // Invalid - should be 2 characters - } - } - }); - - expect(res.statusCode).toBe(400); - }); - - test("Should validate email format", async () => { - const res = await testServer.inject({ - method: "POST", - url: "/api/v3/certificates/issue-certificate", - headers: { - authorization: `Bearer ${jwtAuthToken}` - }, - body: { - profileId, - certificateRequest: { - commonName: "test.example.com", - validity: { - ttl: "24h" - }, - email: "invalid-email" // Invalid email format - } - } - }); - - expect(res.statusCode).toBe(400); - }); - - test("Should validate key usage requirements", async () => { - const res = await testServer.inject({ - method: "POST", - url: "/api/v3/certificates/issue-certificate", - headers: { - authorization: `Bearer ${jwtAuthToken}` - }, - body: { - profileId, - certificateRequest: { - commonName: "test.example.com", - validity: { - ttl: "24h" - }, - keyUsages: [], // Missing required key usages - extendedKeyUsages: [] // Missing required extended key usages - } - } - }); - - expect(res.statusCode).toBe(400); - }); - - test("Should handle empty certificate request", async () => { - const res = await testServer.inject({ - method: "POST", - url: "/api/v3/certificates/issue-certificate", - headers: { - authorization: `Bearer ${jwtAuthToken}` - }, - body: { - profileId, - certificateRequest: {} // Empty certificate request - } - }); - - expect(res.statusCode).toBe(400); - }); - }); - - describe("Authentication", () => { - test("Should require authentication", async () => { - const res = await testServer.inject({ - method: "POST", - url: "/api/v3/certificates/issue-certificate", - body: { - profileId, - certificateRequest: { - commonName: "test.example.com", - validity: { - ttl: "24h" - } - } - } - }); - - expect(res.statusCode).toBe(401); - }); - - test("Should reject invalid token", async () => { - const res = await testServer.inject({ - method: "POST", - url: "/api/v3/certificates/issue-certificate", - headers: { - authorization: "Bearer invalid-token" - }, - body: { - profileId, - certificateRequest: { - commonName: "test.example.com", - validity: { - ttl: "24h" - } - } - } - }); - - expect(res.statusCode).toBe(401); - }); - - test("Should require authentication for CSR signing", async () => { - const res = await testServer.inject({ - method: "POST", - url: "/api/v3/certificates/sign-certificate", - body: { - profileId, - csr: "mock-csr", - validity: { - ttl: "24h" - } - } - }); - - expect(res.statusCode).toBe(401); - }); - - test("Should require authentication for certificate ordering", async () => { - const res = await testServer.inject({ - method: "POST", - url: "/api/v3/certificates/order-certificate", - body: { - profileId, - certificateOrder: { - identifiers: [ - { - type: "dns", - value: "test.example.com" - } - ], - validity: { - ttl: "24h" - } - } - } - }); - - expect(res.statusCode).toBe(401); - }); - }); - - describe("Profile-based Certificate Management", () => { - test("Should create certificates with profile reference", async () => { - const res = await testServer.inject({ - method: "POST", - url: "/api/v3/certificates/issue-certificate", - headers: { - authorization: `Bearer ${jwtAuthToken}` - }, - body: { - profileId, - certificateRequest: { - commonName: "profile-test.example.com", - validity: { - ttl: "24h" - }, - keyUsages: ["digitalSignature"], - extendedKeyUsages: ["serverAuth"] - } - } - }); - - expect(res.statusCode).toBe(200); - const payload = JSON.parse(res.payload); - - // Verify that the certificate was created successfully - expect(payload).toHaveProperty("certificateId"); - expect(typeof payload.certificateId).toBe("string"); - expect(payload.certificateId.length).toBeGreaterThan(0); - - // Verify all required fields are present - expect(payload).toHaveProperty("certificate"); - expect(payload).toHaveProperty("certificateChain"); - expect(payload).toHaveProperty("privateKey"); - expect(payload).toHaveProperty("serialNumber"); - expect(payload).toHaveProperty("issuingCaCertificate"); - }); - - test("Should validate using template policy without template dependency", async () => { - const res = await testServer.inject({ - method: "POST", - url: "/api/v3/certificates/issue-certificate", - headers: { - authorization: `Bearer ${jwtAuthToken}` - }, - body: { - profileId, - certificateRequest: { - commonName: "policy-test.example.com", - validity: { - ttl: "24h" - }, - // Include required key usages as defined in template - keyUsages: ["digitalSignature"], - extendedKeyUsages: ["serverAuth"], - // Test optional attributes - organization: "Policy Test Org", - country: "US" - } - } - }); - - expect(res.statusCode).toBe(200); - const payload = JSON.parse(res.payload); - expect(payload).toHaveProperty("certificate"); - expect(payload).toHaveProperty("certificateId"); - }); - - test("Should handle profile permissions correctly", async () => { - const res = await testServer.inject({ - method: "POST", - url: "/api/v3/certificates/issue-certificate", - headers: { - authorization: `Bearer ${jwtAuthToken}` - }, - body: { - profileId, - certificateRequest: { - commonName: "permission-test.example.com", - validity: { - ttl: "24h" - }, - keyUsages: ["digitalSignature"], - extendedKeyUsages: ["serverAuth"] - } - } - }); - - expect(res.statusCode).toBe(200); - const payload = JSON.parse(res.payload); - expect(payload).toHaveProperty("certificateId"); - }); - }); -});