// In createServer, when SSL is enabled
if (options.ssl && options.ssl.key && options.ssl.cert) {
  const httpsOptions = {
    key: options.ssl.key,
    cert: options.ssl.cert,
    // Enable WebID-TLS
    requestCert: options.webidTls || false,  // Request client cert
    rejectUnauthorized: false  // Don't reject self-signed (we verify via WebID)
  };
  // ... create HTTPS server
}

import { graph, SPARQLToQuery } from 'rdflib';

const SPARQL_QUERY = `
  PREFIX cert: <http://www.w3.org/ns/auth/cert#>
  SELECT ?webid ?m ?e WHERE {
    ?webid cert:key ?key .
    ?key cert:modulus ?m .
    ?key cert:exponent ?e .
  }
`;

/**
 * Extract WebID from client certificate's SubjectAlternativeName
 */
export function getWebIdFromCert(certificate) {
  if (!certificate?.subjectaltname) return null;
  
  const match = certificate.subjectaltname.match(/URI:([^,\s]+)/);
  return match ? match[1] : null;
}

/**
 * Verify certificate public key matches WebID profile
 */
export async function verifyWebIdTls(certificate, webId) {
  if (!certificate.modulus || !certificate.exponent) {
    throw new Error('Certificate missing modulus or exponent');
  }
  
  // Fetch WebID profile
  const response = await fetch(webId, {
    headers: { 'Accept': 'text/turtle, application/ld+json' }
  });
  
  if (!response.ok) {
    throw new Error(`Failed to fetch WebID profile: ${response.status}`);
  }
  
  const body = await response.text();
  const contentType = response.headers.get('content-type')?.split(';')[0];
  
  // Parse profile and find matching key
  const g = graph();
  // ... parse RDF and run SPARQL query
  
  const certModulus = certificate.modulus.toLowerCase();
  const certExponent = parseInt(certificate.exponent, 16).toString();
  
  // Match modulus and exponent from profile
  // Return true if match found, false otherwise
}

/**
 * Middleware to authenticate via WebID-TLS
 */
export async function webIdTlsAuth(request) {
  const socket = request.raw?.socket || request.socket;
  
  if (!socket?.getPeerCertificate) {
    return null; // Not a TLS connection
  }
  
  const cert = socket.getPeerCertificate();
  if (!cert || Object.keys(cert).length === 0) {
    return null; // No client certificate
  }
  
  const webId = getWebIdFromCert(cert);
  if (!webId) {
    return null; // No WebID in certificate
  }
  
  const verified = await verifyWebIdTls(cert, webId);
  return verified ? webId : null;
}

import { webIdTlsAuth } from './webid-tls.js';

export async function getWebIdFromRequestAsync(request) {
  // Try bearer token first
  let webId = await getWebIdFromToken(request);
  
  // Fall back to WebID-TLS
  if (!webId) {
    webId = await webIdTlsAuth(request);
  }
  
  return { webId };
}

.option('--webid-tls', 'Enable WebID-TLS client certificate authentication')

describe('WebID-TLS Authentication', () => {
  it('should extract WebID from certificate SAN', () => {
    const cert = { subjectaltname: 'URI:https://alice.example/card#me' };
    expect(getWebIdFromCert(cert)).toBe('https://alice.example/card#me');
  });
  
  it('should verify certificate against WebID profile', async () => {
    // Mock profile with matching cert:key
    // Verify returns true
  });
  
  it('should reject mismatched certificate', async () => {
    // Mock profile with different key
    // Verify returns false
  });
});