Denozordec
3eb75ea0b8
Docker images / prepare-release (push) Successful in 12s
Docker images / backend-test (push) Successful in 2m41s
Docker images / frontend-image (push) Successful in 2m57s
Docker images / updater-image (push) Successful in 48s
Docker images / backend-image (push) Successful in 2m48s
Docker images / notify-webhook (push) Skipped
Docker images / publish-release (push) Successful in 13s
- Implemented a new backend route for exporting existing client certificates in .p12 format by name. - Enhanced the frontend to support exporting certificates directly from the IPsec server grid. - Updated the IPsec page to manage certificate states and handle exports effectively. - Introduced new utility functions for certificate handling and improved data structures to accommodate the changes. - Added tests to ensure the reliability of the new certificate export feature.
63 lines
2.1 KiB
TypeScript
63 lines
2.1 KiB
TypeScript
import assert from "node:assert/strict"
|
||
import {
|
||
certificateRole,
|
||
isCaCertificate,
|
||
mapRosCertificateRow,
|
||
type RosCertificateRow,
|
||
} from "./certificate-parse.js"
|
||
|
||
// Реальные серты пользователя: MyCA (root) → vpn-server, client1, anakondra.
|
||
const myCa: RosCertificateRow = {
|
||
name: "MyCA",
|
||
"common-name": "MyCA",
|
||
"key-usage": "key-cert-sign,crl-sign",
|
||
ca: "",
|
||
flags: "KAT",
|
||
authority: "true",
|
||
}
|
||
const vpnServer: RosCertificateRow = {
|
||
name: "vpn-server",
|
||
"common-name": "vpn.example.com",
|
||
"key-usage": "digital-signature,key-encipherment,key-cert-sign,crl-sign,tls-server,tls-client",
|
||
ca: "MyCA",
|
||
flags: "KLAT",
|
||
}
|
||
const client1: RosCertificateRow = {
|
||
name: "client1",
|
||
"common-name": "client1",
|
||
"key-usage": "digital-signature,key-encipherment,key-cert-sign,crl-sign,tls-server,tls-client",
|
||
ca: "MyCA",
|
||
flags: "KLAT",
|
||
}
|
||
const anakondra: RosCertificateRow = { ...client1, name: "anakondra", "common-name": "anakondra" }
|
||
|
||
{
|
||
assert.ok(isCaCertificate(myCa))
|
||
// default key-usage содержит key-cert-sign, но ca заполнен → не CA
|
||
assert.ok(!isCaCertificate(vpnServer))
|
||
assert.ok(!isCaCertificate(client1))
|
||
}
|
||
|
||
{
|
||
const ctx = {
|
||
peerCertNames: ["vpn-server"],
|
||
identityCertNames: ["client1", "anakondra"],
|
||
}
|
||
assert.equal(certificateRole(myCa, ctx), "ca")
|
||
assert.equal(certificateRole(vpnServer, ctx), "server")
|
||
// reference-based важнее key-usage: у client1 в key-usage есть tls-server, но он client
|
||
assert.equal(certificateRole(client1, ctx), "client")
|
||
assert.equal(certificateRole(anakondra, ctx), "client")
|
||
// без контекста — по key-usage (default содержит оба, поэтому server)
|
||
assert.equal(certificateRole({ name: "x", "key-usage": "tls-client" }), "client")
|
||
assert.equal(certificateRole({ name: "y", "key-usage": "digital-signature" }), "other")
|
||
}
|
||
|
||
{
|
||
const dto = mapRosCertificateRow(1, "mt", client1)
|
||
assert.equal(dto?.signedByCertName, "MyCA")
|
||
assert.equal(mapRosCertificateRow(1, "mt", myCa)?.signedByCertName, undefined)
|
||
}
|
||
|
||
console.log("certificate-parse.test.ts: ok")
|