@gjsify/tls 0.1.0

package/src/index.spec.ts

@@ -0,0 +1,674 @@
+// Ported from refs/node-test/parallel/test-tls-check-server-identity.js,
+//   test-tls-basic-validations.js, refs/bun/test/js/node/tls/
+// Original: MIT license, Node.js contributors
+
+import { describe, it, expect } from '@gjsify/unit';
+import tls, {
+  TLSSocket,
+  connect,
+  createServer,
+  createSecureContext,
+  checkServerIdentity,
+  getCiphers,
+  rootCertificates,
+  DEFAULT_MIN_VERSION,
+  DEFAULT_MAX_VERSION,
+  DEFAULT_CIPHERS,
+} from 'node:tls';
+
+// Our implementation exports TLSServer, Node.js exports Server
+const TLSServer = (tls as any).TLSServer || (tls as any).Server;
+
+export default async () => {
+  await describe('tls', async () => {
+
+    // ===================== Constants =====================
+    await describe('constants', async () => {
+      await it('should export DEFAULT_MIN_VERSION as TLSv1.2', async () => {
+        expect(DEFAULT_MIN_VERSION).toBe('TLSv1.2');
+      });
+
+      await it('should export DEFAULT_MAX_VERSION as TLSv1.3', async () => {
+        expect(DEFAULT_MAX_VERSION).toBe('TLSv1.3');
+      });
+
+      await it('DEFAULT_CIPHERS should be a non-empty string', async () => {
+        expect(typeof DEFAULT_CIPHERS).toBe('string');
+        expect(DEFAULT_CIPHERS.length).toBeGreaterThan(0);
+      });
+
+      await it('DEFAULT_CIPHERS should contain AES', async () => {
+        expect(DEFAULT_CIPHERS).toContain('AES');
+      });
+
+      await it('DEFAULT_CIPHERS should be colon-separated', async () => {
+        expect(DEFAULT_CIPHERS).toContain(':');
+      });
+    });
+
+    // ===================== Module exports =====================
+    await describe('exports', async () => {
+      await it('should export TLSSocket as a function', async () => {
+        expect(typeof TLSSocket).toBe('function');
+      });
+
+      await it('should export connect as a function', async () => {
+        expect(typeof connect).toBe('function');
+      });
+
+      await it('should export createSecureContext as a function', async () => {
+        expect(typeof createSecureContext).toBe('function');
+      });
+
+      await it('should export rootCertificates as an array', async () => {
+        expect(Array.isArray(rootCertificates)).toBe(true);
+      });
+
+      await it('should export checkServerIdentity as a function', async () => {
+        expect(typeof checkServerIdentity).toBe('function');
+      });
+
+      await it('should export getCiphers as a function', async () => {
+        expect(typeof getCiphers).toBe('function');
+      });
+
+      await it('should export createServer as a function', async () => {
+        expect(typeof createServer).toBe('function');
+      });
+
+      await it('should have all exports on default export', async () => {
+        expect(typeof tls.TLSSocket).toBe('function');
+        expect(typeof tls.connect).toBe('function');
+        expect(typeof tls.createSecureContext).toBe('function');
+        expect(typeof tls.checkServerIdentity).toBe('function');
+        expect(typeof tls.getCiphers).toBe('function');
+        expect(typeof tls.createServer).toBe('function');
+        expect(Array.isArray(tls.rootCertificates)).toBe(true);
+        expect(tls.DEFAULT_MIN_VERSION).toBe('TLSv1.2');
+        expect(tls.DEFAULT_MAX_VERSION).toBe('TLSv1.3');
+        expect(typeof tls.DEFAULT_CIPHERS).toBe('string');
+      });
+    });
+
+    // ===================== TLSSocket =====================
+    await describe('TLSSocket', async () => {
+      await it('should be constructable', async () => {
+        const socket = new TLSSocket(undefined as any);
+        expect(socket).toBeDefined();
+      });
+
+      await it('should have encrypted property set to true', async () => {
+        const socket = new TLSSocket(undefined as any);
+        expect(socket.encrypted).toBe(true);
+      });
+
+      await it('should have authorized property as boolean', async () => {
+        const socket = new TLSSocket(undefined as any);
+        expect(typeof socket.authorized).toBe('boolean');
+      });
+
+      await it('authorized should default to false', async () => {
+        const socket = new TLSSocket(undefined as any);
+        expect(socket.authorized).toBe(false);
+      });
+
+      await it('should have getPeerCertificate method', async () => {
+        const socket = new TLSSocket(undefined as any);
+        expect(typeof socket.getPeerCertificate).toBe('function');
+      });
+
+      await it('should have getProtocol method', async () => {
+        const socket = new TLSSocket(undefined as any);
+        expect(typeof socket.getProtocol).toBe('function');
+      });
+
+      await it('should have getCipher method', async () => {
+        const socket = new TLSSocket(undefined as any);
+        expect(typeof socket.getCipher).toBe('function');
+      });
+
+      await it('should have alpnProtocol property', async () => {
+        const socket = new TLSSocket(undefined as any);
+        // Node.js: alpnProtocol is a property (null or string), our impl: false or string
+        const val = (socket as any).alpnProtocol;
+        expect(val === false || val === null || typeof val === 'string').toBe(true);
+      });
+
+      await it('getPeerCertificate should return object when not connected', async () => {
+        const socket = new TLSSocket(undefined as any);
+        const cert = socket.getPeerCertificate();
+        expect(typeof cert).toBe('object');
+      });
+
+      await it('getProtocol should return null when not connected', async () => {
+        const socket = new TLSSocket(undefined as any);
+        const proto = socket.getProtocol();
+        expect(proto === null || typeof proto === 'string').toBe(true);
+      });
+
+      await it('getCipher should return null when not connected', async () => {
+        const socket = new TLSSocket(undefined as any);
+        const cipher = socket.getCipher();
+        expect(cipher === null || cipher === undefined || typeof cipher === 'object').toBe(true);
+      });
+
+      await it('alpnProtocol should default to false', async () => {
+        const socket = new TLSSocket(undefined as any);
+        expect((socket as any).alpnProtocol === false || (socket as any).alpnProtocol === null).toBe(true);
+      });
+
+      await it('authorizationError should be undefined initially', async () => {
+        const socket = new TLSSocket(undefined as any);
+        expect(socket.authorizationError === undefined || socket.authorizationError === null).toBe(true);
+      });
+
+      await it('should extend Socket (EventEmitter)', async () => {
+        const socket = new TLSSocket(undefined as any);
+        expect(typeof socket.on).toBe('function');
+        expect(typeof socket.emit).toBe('function');
+        expect(typeof socket.once).toBe('function');
+        expect(typeof socket.removeListener).toBe('function');
+      });
+
+      await it('should have destroy method', async () => {
+        const socket = new TLSSocket(undefined as any);
+        expect(typeof socket.destroy).toBe('function');
+      });
+
+      await it('should have write method', async () => {
+        const socket = new TLSSocket(undefined as any);
+        expect(typeof socket.write).toBe('function');
+      });
+
+      await it('should have end method', async () => {
+        const socket = new TLSSocket(undefined as any);
+        expect(typeof socket.end).toBe('function');
+      });
+    });
+
+    // ===================== TLSServer / createServer =====================
+    await describe('TLSServer', async () => {
+      await it('should export TLSServer as a function', async () => {
+        expect(typeof TLSServer).toBe('function');
+      });
+
+      await it('should export createServer as a function', async () => {
+        expect(typeof createServer).toBe('function');
+      });
+
+      await it('should be constructable', async () => {
+        const server = new TLSServer();
+        expect(server).toBeDefined();
+      });
+
+      await it('createServer should return a TLSServer', async () => {
+        const server = createServer();
+        expect(server).toBeDefined();
+      });
+
+      await it('createServer should accept a listener', async () => {
+        const server = createServer(() => {});
+        expect(server).toBeDefined();
+      });
+
+      await it('createServer should accept options and listener', async () => {
+        const server = createServer({ cert: '', key: '' }, () => {});
+        expect(server).toBeDefined();
+      });
+
+      await it('should have addContext method', async () => {
+        const server = new TLSServer();
+        expect(typeof server.addContext).toBe('function');
+      });
+
+      await it('should have listen method', async () => {
+        const server = new TLSServer();
+        expect(typeof server.listen).toBe('function');
+      });
+
+      await it('should have close method', async () => {
+        const server = new TLSServer();
+        expect(typeof server.close).toBe('function');
+      });
+
+      await it('should have address method', async () => {
+        const server = new TLSServer();
+        expect(typeof server.address).toBe('function');
+      });
+
+      await it('should be an EventEmitter', async () => {
+        const server = new TLSServer();
+        expect(typeof server.on).toBe('function');
+        expect(typeof server.emit).toBe('function');
+        expect(typeof server.once).toBe('function');
+      });
+    });
+
+    // ===================== createSecureContext =====================
+    await describe('createSecureContext', async () => {
+      await it('should return a context object', async () => {
+        const ctx = createSecureContext();
+        expect(ctx).toBeDefined();
+        expect(typeof ctx).toBe('object');
+      });
+
+      await it('should accept empty options', async () => {
+        const ctx = createSecureContext({});
+        expect(ctx).toBeDefined();
+      });
+
+      await it('should have context property', async () => {
+        const ctx = createSecureContext();
+        expect(ctx.context !== undefined).toBe(true);
+      });
+
+      await it('should return same type for repeated calls', async () => {
+        const ctx1 = createSecureContext();
+        const ctx2 = createSecureContext();
+        expect(typeof ctx1).toBe(typeof ctx2);
+      });
+    });
+
+    // ===================== getCiphers =====================
+    await describe('getCiphers', async () => {
+      await it('should return an array of strings', async () => {
+        const ciphers = getCiphers();
+        expect(Array.isArray(ciphers)).toBe(true);
+        expect(ciphers.length).toBeGreaterThan(0);
+        for (const c of ciphers) {
+          expect(typeof c).toBe('string');
+        }
+      });
+
+      await it('should be on the default export', async () => {
+        expect(typeof tls.getCiphers).toBe('function');
+        const ciphers = tls.getCiphers();
+        expect(Array.isArray(ciphers)).toBe(true);
+      });
+
+      await it('should contain lowercase cipher names', async () => {
+        const ciphers = getCiphers();
+        for (const c of ciphers) {
+          expect(c).toBe(c.toLowerCase());
+        }
+      });
+
+      await it('should contain aes ciphers', async () => {
+        const ciphers = getCiphers();
+        const hasAes = ciphers.some(c => c.includes('aes'));
+        expect(hasAes).toBe(true);
+      });
+
+      await it('should not contain duplicates', async () => {
+        const ciphers = getCiphers();
+        const unique = new Set(ciphers);
+        expect(unique.size).toBe(ciphers.length);
+      });
+    });
+
+    // ===================== connect =====================
+    await describe('tls.connect', async () => {
+      await it('should be a function', async () => {
+        expect(typeof connect).toBe('function');
+      });
+
+      await it('should be on the default export', async () => {
+        expect(typeof tls.connect).toBe('function');
+      });
+    });
+
+    // ===================== checkServerIdentity =====================
+    // Comprehensive tests ported from refs/node-test/parallel/test-tls-check-server-identity.js
+    await describe('checkServerIdentity', async () => {
+
+      // --- Basic function checks ---
+      await it('should be a function', async () => {
+        expect(typeof checkServerIdentity).toBe('function');
+        expect(typeof tls.checkServerIdentity).toBe('function');
+      });
+
+      // --- CN matching ---
+      await describe('CN matching', async () => {
+        await it('should return undefined for exact CN match', async () => {
+          const result = checkServerIdentity('a.com', { subject: { CN: 'a.com' } } as any);
+          expect(result).toBeUndefined();
+        });
+
+        await it('should match CN case-insensitively', async () => {
+          const result = checkServerIdentity('a.com', { subject: { CN: 'A.COM' } } as any);
+          expect(result).toBeUndefined();
+        });
+
+        await it('should return error for non-matching CN', async () => {
+          const err = checkServerIdentity('a.com', { subject: { CN: 'b.com' } } as any);
+          expect(err instanceof Error).toBe(true);
+        });
+
+        await it('should handle trailing-dot FQDN in hostname', async () => {
+          const result = checkServerIdentity('a.com.', { subject: { CN: 'a.com' } } as any);
+          expect(result).toBeUndefined();
+        });
+
+        await it('should handle trailing-dot FQDN in CN', async () => {
+          const result = checkServerIdentity('a.com', { subject: { CN: 'a.com.' } } as any);
+          expect(result).toBeUndefined();
+        });
+
+        await it('should handle trailing dots on both sides', async () => {
+          const result = checkServerIdentity('a.com.', { subject: { CN: 'a.com.' } } as any);
+          expect(result).toBeUndefined();
+        });
+
+        await it('should match array CN values', async () => {
+          const result = checkServerIdentity('b.com', {
+            subject: { CN: ['a.com', 'b.com'] },
+          } as any);
+          expect(result).toBeUndefined();
+        });
+
+        await it('should fail when hostname not in CN array', async () => {
+          const err = checkServerIdentity('c.com', {
+            subject: { CN: ['a.com', 'b.com'] },
+          } as any);
+          expect(err instanceof Error).toBe(true);
+        });
+
+        await it('should handle single-label hostname with single-label CN', async () => {
+          const result = checkServerIdentity('localhost', {
+            subject: { CN: 'localhost' },
+          } as any);
+          expect(result).toBeUndefined();
+        });
+      });
+
+      // --- Wildcard matching ---
+      await describe('wildcard matching', async () => {
+        await it('should match *.example.com against sub.example.com', async () => {
+          const result = checkServerIdentity('sub.example.com', {
+            subject: {},
+            subjectaltname: 'DNS:*.example.com',
+          } as any);
+          expect(result).toBeUndefined();
+        });
+
+        await it('should NOT match *.example.com against nested.sub.example.com', async () => {
+          const err = checkServerIdentity('nested.sub.example.com', {
+            subject: {},
+            subjectaltname: 'DNS:*.example.com',
+          } as any);
+          expect(err instanceof Error).toBe(true);
+        });
+
+        await it('should NOT match *.example.com against example.com itself', async () => {
+          const err = checkServerIdentity('example.com', {
+            subject: {},
+            subjectaltname: 'DNS:*.example.com',
+          } as any);
+          expect(err instanceof Error).toBe(true);
+        });
+
+        await it('should match wildcard CN when no SANs present', async () => {
+          const result = checkServerIdentity('foo.example.com', {
+            subject: { CN: '*.example.com' },
+          } as any);
+          expect(result).toBeUndefined();
+        });
+
+        await it('wildcard CN should NOT match two-level deep', async () => {
+          const err = checkServerIdentity('a.b.example.com', {
+            subject: { CN: '*.example.com' },
+          } as any);
+          expect(err instanceof Error).toBe(true);
+        });
+
+        await it('should match wildcard with different subdomains', async () => {
+          const result1 = checkServerIdentity('foo.example.com', {
+            subject: {},
+            subjectaltname: 'DNS:*.example.com',
+          } as any);
+          expect(result1).toBeUndefined();
+
+          const result2 = checkServerIdentity('bar.example.com', {
+            subject: {},
+            subjectaltname: 'DNS:*.example.com',
+          } as any);
+          expect(result2).toBeUndefined();
+        });
+      });
+
+      // --- DNS SAN matching ---
+      await describe('DNS SAN matching', async () => {
+        await it('should match hostname in DNS SAN', async () => {
+          const result = checkServerIdentity('foo.example.com', {
+            subject: { CN: 'wrong.com' },
+            subjectaltname: 'DNS:foo.example.com',
+          } as any);
+          expect(result).toBeUndefined();
+        });
+
+        await it('SAN takes precedence over CN', async () => {
+          // When SANs are present, CN should be ignored
+          const err = checkServerIdentity('wrong.com', {
+            subject: { CN: 'wrong.com' },
+            subjectaltname: 'DNS:right.com',
+          } as any);
+          expect(err instanceof Error).toBe(true);
+        });
+
+        await it('should handle multiple DNS SANs', async () => {
+          const result = checkServerIdentity('b.com', {
+            subject: { CN: 'a.com' },
+            subjectaltname: 'DNS:a.com, DNS:b.com',
+          } as any);
+          expect(result).toBeUndefined();
+        });
+
+        await it('should fail when hostname not in any DNS SAN', async () => {
+          const err = checkServerIdentity('c.com', {
+            subject: { CN: 'c.com' },
+            subjectaltname: 'DNS:a.com, DNS:b.com',
+          } as any);
+          expect(err instanceof Error).toBe(true);
+        });
+
+        await it('should match wildcard DNS SAN', async () => {
+          const result = checkServerIdentity('bar.example.com', {
+            subject: { CN: 'wrong.com' },
+            subjectaltname: 'DNS:*.example.com',
+          } as any);
+          expect(result).toBeUndefined();
+        });
+
+        await it('should handle mixed DNS and IP SANs', async () => {
+          const result = checkServerIdentity('example.com', {
+            subject: {},
+            subjectaltname: 'DNS:example.com, IP Address:1.2.3.4',
+          } as any);
+          expect(result).toBeUndefined();
+        });
+
+        await it('should handle DNS SAN with trailing whitespace', async () => {
+          const result = checkServerIdentity('example.com', {
+            subject: {},
+            subjectaltname: 'DNS:example.com ',
+          } as any);
+          // May or may not match depending on trimming
+          expect(result === undefined || result instanceof Error).toBe(true);
+        });
+      });
+
+      // --- IP address matching ---
+      await describe('IP address matching', async () => {
+        await it('should match IPv4 in IP Address SAN', async () => {
+          const result = checkServerIdentity('8.8.8.8', {
+            subject: { CN: '8.8.8.8' },
+            subjectaltname: 'IP Address:8.8.8.8',
+          } as any);
+          expect(result).toBeUndefined();
+        });
+
+        await it('should fail IPv4 not in IP Address SAN', async () => {
+          const err = checkServerIdentity('8.8.4.4', {
+            subject: { CN: '8.8.4.4' },
+            subjectaltname: 'IP Address:8.8.8.8',
+          } as any);
+          expect(err instanceof Error).toBe(true);
+        });
+
+        await it('should fail IPv4 with only CN (no SAN IP entry)', async () => {
+          const err = checkServerIdentity('8.8.8.8', {
+            subject: { CN: '8.8.8.8' },
+          } as any);
+          expect(err instanceof Error).toBe(true);
+        });
+
+        await it('should match multiple IP addresses in SAN', async () => {
+          const result = checkServerIdentity('1.2.3.4', {
+            subject: {},
+            subjectaltname: 'IP Address:1.2.3.4, IP Address:5.6.7.8',
+          } as any);
+          expect(result).toBeUndefined();
+        });
+
+        await it('should match second IP in SAN', async () => {
+          const result = checkServerIdentity('5.6.7.8', {
+            subject: {},
+            subjectaltname: 'IP Address:1.2.3.4, IP Address:5.6.7.8',
+          } as any);
+          expect(result).toBeUndefined();
+        });
+
+        await it('should handle IPv6 in IP Address SAN', async () => {
+          const result = checkServerIdentity('::1', {
+            subject: {},
+            subjectaltname: 'IP Address:::1',
+          } as any);
+          expect(result).toBeUndefined();
+        });
+
+        await it('should fail IPv4 in DNS SAN (IP should use IP Address SAN)', async () => {
+          const err = checkServerIdentity('1.2.3.4', {
+            subject: {},
+            subjectaltname: 'DNS:1.2.3.4',
+          } as any);
+          expect(err instanceof Error).toBe(true);
+        });
+      });
+
+      // --- Error object properties ---
+      await describe('error properties', async () => {
+        await it('should have reason property on error', async () => {
+          const err = checkServerIdentity('a.com', { subject: { CN: 'b.com' } } as any) as any;
+          expect(err instanceof Error).toBe(true);
+          expect(typeof err.reason).toBe('string');
+        });
+
+        await it('should have host property on error', async () => {
+          const err = checkServerIdentity('a.com', { subject: { CN: 'b.com' } } as any) as any;
+          expect(err.host).toBe('a.com');
+        });
+
+        await it('should have cert property on error', async () => {
+          const cert = { subject: { CN: 'b.com' } } as any;
+          const err = checkServerIdentity('a.com', cert) as any;
+          expect(err.cert).toBe(cert);
+        });
+
+        await it('error message should contain hostname for CN mismatch', async () => {
+          const err = checkServerIdentity('a.com', { subject: { CN: 'b.com' } } as any);
+          expect(err instanceof Error).toBe(true);
+          expect((err as Error).message).toContain('a.com');
+        });
+
+        await it('error message should contain IP for IP mismatch', async () => {
+          const err = checkServerIdentity('8.8.8.8', {
+            subject: {},
+            subjectaltname: 'IP Address:1.2.3.4',
+          } as any);
+          expect(err instanceof Error).toBe(true);
+          expect((err as Error).message).toContain('8.8.8.8');
+        });
+      });
+
+      // --- Edge cases ---
+      await describe('edge cases', async () => {
+        await it('should return error when cert has no subject and no altnames', async () => {
+          const err = checkServerIdentity('a.com', {} as any);
+          expect(err instanceof Error).toBe(true);
+          expect((err as Error).message).toContain('DNS');
+        });
+
+        await it('should handle false-y host values', async () => {
+          const err = checkServerIdentity(false as unknown as string, {
+            subject: { CN: 'a.com' },
+          } as any);
+          expect(err instanceof Error).toBe(true);
+        });
+
+        await it('should handle empty string hostname', async () => {
+          const err = checkServerIdentity('', { subject: { CN: 'a.com' } } as any);
+          expect(err instanceof Error).toBe(true);
+        });
+
+        await it('should handle empty CN', async () => {
+          const err = checkServerIdentity('a.com', { subject: { CN: '' } } as any);
+          expect(err instanceof Error).toBe(true);
+        });
+
+        await it('should handle undefined CN', async () => {
+          const err = checkServerIdentity('a.com', { subject: {} } as any);
+          expect(err instanceof Error).toBe(true);
+        });
+
+        await it('should handle empty subjectaltname string', async () => {
+          const err = checkServerIdentity('a.com', {
+            subject: { CN: 'a.com' },
+            subjectaltname: '',
+          } as any);
+          // Empty altname means CN fallback
+          expect(err === undefined || err instanceof Error).toBe(true);
+        });
+
+        await it('should handle numeric hostname as string', async () => {
+          const result = checkServerIdentity('127.0.0.1', {
+            subject: {},
+            subjectaltname: 'IP Address:127.0.0.1',
+          } as any);
+          expect(result).toBeUndefined();
+        });
+
+        await it('should handle cert with only URI SAN (no DNS, no IP)', async () => {
+          const err = checkServerIdentity('a.com', {
+            subject: {},
+            subjectaltname: 'URI:https://a.com',
+          } as any);
+          // URI SANs don't count for hostname verification
+          expect(err instanceof Error).toBe(true);
+        });
+
+        await it('should handle cert with email SAN only', async () => {
+          const err = checkServerIdentity('a.com', {
+            subject: {},
+            subjectaltname: 'email:admin@a.com',
+          } as any);
+          expect(err instanceof Error).toBe(true);
+        });
+      });
+    });
+
+    // ===================== rootCertificates =====================
+    await describe('rootCertificates', async () => {
+      await it('should be an array', async () => {
+        expect(Array.isArray(rootCertificates)).toBe(true);
+      });
+
+      await it('should be on default export', async () => {
+        expect(Array.isArray(tls.rootCertificates)).toBe(true);
+      });
+
+      await it('should be the same reference on default and named export', async () => {
+        expect(tls.rootCertificates).toBe(rootCertificates);
+      });
+    });
+  });
+};