-
Notifications
You must be signed in to change notification settings - Fork 7
Expand file tree
/
Copy pathwebid-tls.test.js
More file actions
119 lines (105 loc) · 4.06 KB
/
webid-tls.test.js
File metadata and controls
119 lines (105 loc) · 4.06 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
/**
* WebID-TLS Authentication tests
*
* Tests the WebID-TLS certificate parsing and verification logic.
*/
import { describe, it } from 'node:test';
import assert from 'node:assert';
import {
extractWebIdFromSAN,
verifyWebIdTls,
clearCache
} from '../src/auth/webid-tls.js';
describe('WebID-TLS', () => {
describe('extractWebIdFromSAN', () => {
it('should extract WebID from simple SAN', () => {
const san = 'URI:https://alice.example/card#me';
const webId = extractWebIdFromSAN(san);
assert.strictEqual(webId, 'https://alice.example/card#me');
});
it('should extract WebID from multi-value SAN', () => {
const san = 'URI:https://bob.example/profile/card#me, DNS:example.com, IP:192.168.1.1';
const webId = extractWebIdFromSAN(san);
assert.strictEqual(webId, 'https://bob.example/profile/card#me');
});
it('should return null for missing SAN', () => {
const webId = extractWebIdFromSAN(null);
assert.strictEqual(webId, null);
});
it('should return null for SAN without URI', () => {
const san = 'DNS:example.com, IP:192.168.1.1';
const webId = extractWebIdFromSAN(san);
assert.strictEqual(webId, null);
});
it('should handle URI without spaces', () => {
const san = 'URI:https://user.example/me,DNS:example.com';
const webId = extractWebIdFromSAN(san);
assert.strictEqual(webId, 'https://user.example/me');
});
});
describe('verifyWebIdTls', () => {
// Clear cache before each test
it('should reject certificate without modulus', async () => {
clearCache();
const cert = { exponent: '10001' }; // Missing modulus
try {
await verifyWebIdTls(cert, 'https://example.com/card#me');
assert.fail('Should have thrown an error');
} catch (err) {
assert.ok(err.message.includes('modulus'));
}
});
it('should reject certificate without exponent', async () => {
clearCache();
const cert = { modulus: 'abc123' }; // Missing exponent
try {
await verifyWebIdTls(cert, 'https://example.com/card#me');
assert.fail('Should have thrown an error');
} catch (err) {
assert.ok(err.message.includes('exponent'));
}
});
});
describe('Certificate key extraction', () => {
it('should extract keys from JSON-LD profile with cert:key', async () => {
// This tests the internal extractCertKeys function indirectly
// by checking that profiles are fetched and parsed correctly
clearCache();
// A minimal test - full integration would need a mock server
// For now we just ensure the functions are callable
const cert = {
modulus: 'abc123def456',
exponent: '10001' // 65537 in hex
};
try {
// This will fail because the profile URL doesn't exist
// but it tests that the function runs without syntax errors
const result = await verifyWebIdTls(cert, 'https://nonexistent.example/card#me');
assert.strictEqual(result, false);
} catch (err) {
// Expected to fail on network error
assert.ok(true);
}
});
});
describe('SAN format variations', () => {
it('should handle lowercase uri prefix', () => {
// Some certs might have lowercase
const san = 'uri:https://alice.example/card#me';
// Our regex is case-sensitive, which matches the standard
const webId = extractWebIdFromSAN(san);
assert.strictEqual(webId, null); // Should not match lowercase
});
it('should extract first URI when multiple are present', () => {
const san = 'URI:https://primary.example/me, URI:https://secondary.example/me';
const webId = extractWebIdFromSAN(san);
assert.strictEqual(webId, 'https://primary.example/me');
});
it('should handle spaces in SAN format', () => {
const san = 'URI: https://alice.example/card#me';
const webId = extractWebIdFromSAN(san);
// With space after colon, it captures from the space
assert.ok(webId === null || webId === ' https://alice.example/card#me');
});
});
});