@gjsify/tls 0.3.20 → 0.4.0

package/src/index.spec.ts

@@ -1,6 +1,8 @@
+// SPDX-License-Identifier: MIT
 // Ported from refs/node-test/parallel/test-tls-check-server-identity.js,
-//   test-tls-basic-validations.js, refs/bun/test/js/node/tls/
-// Original: MIT license, Node.js contributors
+//   test-tls-basic-validations.js, refs/bun/test/js/node/tls/.
+// Original: Copyright (c) Node.js contributors. MIT.
+// Rewritten for @gjsify/unit — behavior preserved, assertion dialect adapted.
 
 import { describe, it, expect } from '@gjsify/unit';
 import tls, {
@@ -15,9 +17,30 @@ import tls, {
   DEFAULT_MAX_VERSION,
   DEFAULT_CIPHERS,
 } from 'node:tls';
-
-// Our implementation exports TLSServer, Node.js exports Server
-const TLSServer = (tls as any).TLSServer || (tls as any).Server;
+import type { PeerCertificate } from 'node:tls';
+
+// Build a fake PeerCertificate from minimal fields. Lets us drive
+// `checkServerIdentity` from tests without crafting a real DER cert.
+// `@types/node`'s PeerCertificate has many more fields than we expose; the
+// `as unknown as PeerCertificate` keeps the test free of `as any`.
+function fakeCert(parts: Record<string, unknown>): PeerCertificate {
+  return parts as unknown as PeerCertificate;
+}
+
+// Our implementation also exports TLSServer; Node only exports Server.
+const tlsRecord = tls as unknown as Record<string, unknown>;
+const TLSServer = (tlsRecord.TLSServer ?? tlsRecord.Server) as new (
+  options?: unknown,
+  secureConnectionListener?: unknown,
+) => {
+  on: (ev: string, cb: (...a: unknown[]) => void) => unknown;
+  emit: (ev: string, ...a: unknown[]) => boolean;
+  once: (ev: string, cb: (...a: unknown[]) => void) => unknown;
+  addContext: (host: string, ctx: unknown) => void;
+  listen: (...a: unknown[]) => unknown;
+  close: (cb?: () => void) => unknown;
+  address: () => unknown;
+};
 
 export default async () => {
   await describe('tls', async () => {
@@ -93,77 +116,77 @@ export default async () => {
     // ===================== TLSSocket =====================
     await describe('TLSSocket', async () => {
       await it('should be constructable', async () => {
-        const socket = new TLSSocket(undefined as any);
+        const socket = new TLSSocket(undefined as unknown as import("net").Socket);
         expect(socket).toBeDefined();
       });
 
       await it('should have encrypted property set to true', async () => {
-        const socket = new TLSSocket(undefined as any);
+        const socket = new TLSSocket(undefined as unknown as import("net").Socket);
         expect(socket.encrypted).toBe(true);
       });
 
       await it('should have authorized property as boolean', async () => {
-        const socket = new TLSSocket(undefined as any);
+        const socket = new TLSSocket(undefined as unknown as import("net").Socket);
         expect(typeof socket.authorized).toBe('boolean');
       });
 
       await it('authorized should default to false', async () => {
-        const socket = new TLSSocket(undefined as any);
+        const socket = new TLSSocket(undefined as unknown as import("net").Socket);
         expect(socket.authorized).toBe(false);
       });
 
       await it('should have getPeerCertificate method', async () => {
-        const socket = new TLSSocket(undefined as any);
+        const socket = new TLSSocket(undefined as unknown as import("net").Socket);
         expect(typeof socket.getPeerCertificate).toBe('function');
       });
 
       await it('should have getProtocol method', async () => {
-        const socket = new TLSSocket(undefined as any);
+        const socket = new TLSSocket(undefined as unknown as import("net").Socket);
         expect(typeof socket.getProtocol).toBe('function');
       });
 
       await it('should have getCipher method', async () => {
-        const socket = new TLSSocket(undefined as any);
+        const socket = new TLSSocket(undefined as unknown as import("net").Socket);
         expect(typeof socket.getCipher).toBe('function');
       });
 
       await it('should have alpnProtocol property', async () => {
-        const socket = new TLSSocket(undefined as any);
+        const socket = new TLSSocket(undefined as unknown as import("net").Socket);
         // Node.js: alpnProtocol is a property (null or string), our impl: false or string
-        const val = (socket as any).alpnProtocol;
+        const val = socket.alpnProtocol;
         expect(val === false || val === null || typeof val === 'string').toBe(true);
       });
 
       await it('getPeerCertificate should return object when not connected', async () => {
-        const socket = new TLSSocket(undefined as any);
+        const socket = new TLSSocket(undefined as unknown as import("net").Socket);
         const cert = socket.getPeerCertificate();
         expect(typeof cert).toBe('object');
       });
 
       await it('getProtocol should return null when not connected', async () => {
-        const socket = new TLSSocket(undefined as any);
+        const socket = new TLSSocket(undefined as unknown as import("net").Socket);
         const proto = socket.getProtocol();
         expect(proto === null || typeof proto === 'string').toBe(true);
       });
 
       await it('getCipher should return null when not connected', async () => {
-        const socket = new TLSSocket(undefined as any);
+        const socket = new TLSSocket(undefined as unknown as import("net").Socket);
         const cipher = socket.getCipher();
         expect(cipher === null || cipher === undefined || typeof cipher === 'object').toBe(true);
       });
 
       await it('alpnProtocol should default to false', async () => {
-        const socket = new TLSSocket(undefined as any);
-        expect((socket as any).alpnProtocol === false || (socket as any).alpnProtocol === null).toBe(true);
+        const socket = new TLSSocket(undefined as unknown as import("net").Socket);
+        expect(socket.alpnProtocol === false || socket.alpnProtocol === null).toBe(true);
       });
 
       await it('authorizationError should be undefined initially', async () => {
-        const socket = new TLSSocket(undefined as any);
+        const socket = new TLSSocket(undefined as unknown as import("net").Socket);
         expect(socket.authorizationError === undefined || socket.authorizationError === null).toBe(true);
       });
 
       await it('should extend Socket (EventEmitter)', async () => {
-        const socket = new TLSSocket(undefined as any);
+        const socket = new TLSSocket(undefined as unknown as import("net").Socket);
         expect(typeof socket.on).toBe('function');
         expect(typeof socket.emit).toBe('function');
         expect(typeof socket.once).toBe('function');
@@ -171,17 +194,17 @@ export default async () => {
       });
 
       await it('should have destroy method', async () => {
-        const socket = new TLSSocket(undefined as any);
+        const socket = new TLSSocket(undefined as unknown as import("net").Socket);
         expect(typeof socket.destroy).toBe('function');
       });
 
       await it('should have write method', async () => {
-        const socket = new TLSSocket(undefined as any);
+        const socket = new TLSSocket(undefined as unknown as import("net").Socket);
         expect(typeof socket.write).toBe('function');
       });
 
       await it('should have end method', async () => {
-        const socket = new TLSSocket(undefined as any);
+        const socket = new TLSSocket(undefined as unknown as import("net").Socket);
         expect(typeof socket.end).toBe('function');
       });
     });
@@ -259,7 +282,7 @@ export default async () => {
 
       await it('should have context property', async () => {
         const ctx = createSecureContext();
-        expect(ctx.context !== undefined).toBe(true);
+        expect((ctx as { context?: unknown }).context !== undefined).toBe(true);
       });
 
       await it('should return same type for repeated calls', async () => {
@@ -330,53 +353,53 @@ export default async () => {
       // --- CN matching ---
       await describe('CN matching', async () => {
         await it('should return undefined for exact CN match', async () => {
-          const result = checkServerIdentity('a.com', { subject: { CN: 'a.com' } } as any);
+          const result = checkServerIdentity('a.com', fakeCert({ subject: { CN: 'a.com' } }));
           expect(result).toBeUndefined();
         });
 
         await it('should match CN case-insensitively', async () => {
-          const result = checkServerIdentity('a.com', { subject: { CN: 'A.COM' } } as any);
+          const result = checkServerIdentity('a.com', fakeCert({ subject: { CN: 'A.COM' } }));
           expect(result).toBeUndefined();
         });
 
         await it('should return error for non-matching CN', async () => {
-          const err = checkServerIdentity('a.com', { subject: { CN: 'b.com' } } as any);
+          const err = checkServerIdentity('a.com', fakeCert({ subject: { CN: 'b.com' } }));
           expect(err instanceof Error).toBe(true);
         });
 
         await it('should handle trailing-dot FQDN in hostname', async () => {
-          const result = checkServerIdentity('a.com.', { subject: { CN: 'a.com' } } as any);
+          const result = checkServerIdentity('a.com.', fakeCert({ subject: { CN: 'a.com' } }));
           expect(result).toBeUndefined();
         });
 
         await it('should handle trailing-dot FQDN in CN', async () => {
-          const result = checkServerIdentity('a.com', { subject: { CN: 'a.com.' } } as any);
+          const result = checkServerIdentity('a.com', fakeCert({ subject: { CN: 'a.com.' } }));
           expect(result).toBeUndefined();
         });
 
         await it('should handle trailing dots on both sides', async () => {
-          const result = checkServerIdentity('a.com.', { subject: { CN: 'a.com.' } } as any);
+          const result = checkServerIdentity('a.com.', fakeCert({ subject: { CN: 'a.com.' } }));
           expect(result).toBeUndefined();
         });
 
         await it('should match array CN values', async () => {
-          const result = checkServerIdentity('b.com', {
+          const result = checkServerIdentity('b.com', fakeCert({
             subject: { CN: ['a.com', 'b.com'] },
-          } as any);
+          }));
           expect(result).toBeUndefined();
         });
 
         await it('should fail when hostname not in CN array', async () => {
-          const err = checkServerIdentity('c.com', {
+          const err = checkServerIdentity('c.com', fakeCert({
             subject: { CN: ['a.com', 'b.com'] },
-          } as any);
+          }));
           expect(err instanceof Error).toBe(true);
         });
 
         await it('should handle single-label hostname with single-label CN', async () => {
-          const result = checkServerIdentity('localhost', {
+          const result = checkServerIdentity('localhost', fakeCert({
             subject: { CN: 'localhost' },
-          } as any);
+          }));
           expect(result).toBeUndefined();
         });
       });
@@ -384,54 +407,54 @@ export default async () => {
       // --- Wildcard matching ---
       await describe('wildcard matching', async () => {
         await it('should match *.example.com against sub.example.com', async () => {
-          const result = checkServerIdentity('sub.example.com', {
+          const result = checkServerIdentity('sub.example.com', fakeCert({
             subject: {},
             subjectaltname: 'DNS:*.example.com',
-          } as any);
+          }));
           expect(result).toBeUndefined();
         });
 
         await it('should NOT match *.example.com against nested.sub.example.com', async () => {
-          const err = checkServerIdentity('nested.sub.example.com', {
+          const err = checkServerIdentity('nested.sub.example.com', fakeCert({
             subject: {},
             subjectaltname: 'DNS:*.example.com',
-          } as any);
+          }));
           expect(err instanceof Error).toBe(true);
         });
 
         await it('should NOT match *.example.com against example.com itself', async () => {
-          const err = checkServerIdentity('example.com', {
+          const err = checkServerIdentity('example.com', fakeCert({
             subject: {},
             subjectaltname: 'DNS:*.example.com',
-          } as any);
+          }));
           expect(err instanceof Error).toBe(true);
         });
 
         await it('should match wildcard CN when no SANs present', async () => {
-          const result = checkServerIdentity('foo.example.com', {
+          const result = checkServerIdentity('foo.example.com', fakeCert({
             subject: { CN: '*.example.com' },
-          } as any);
+          }));
           expect(result).toBeUndefined();
         });
 
         await it('wildcard CN should NOT match two-level deep', async () => {
-          const err = checkServerIdentity('a.b.example.com', {
+          const err = checkServerIdentity('a.b.example.com', fakeCert({
             subject: { CN: '*.example.com' },
-          } as any);
+          }));
           expect(err instanceof Error).toBe(true);
         });
 
         await it('should match wildcard with different subdomains', async () => {
-          const result1 = checkServerIdentity('foo.example.com', {
+          const result1 = checkServerIdentity('foo.example.com', fakeCert({
             subject: {},
             subjectaltname: 'DNS:*.example.com',
-          } as any);
+          }));
           expect(result1).toBeUndefined();
 
-          const result2 = checkServerIdentity('bar.example.com', {
+          const result2 = checkServerIdentity('bar.example.com', fakeCert({
             subject: {},
             subjectaltname: 'DNS:*.example.com',
-          } as any);
+          }));
           expect(result2).toBeUndefined();
         });
       });
@@ -439,59 +462,59 @@ export default async () => {
       // --- DNS SAN matching ---
       await describe('DNS SAN matching', async () => {
         await it('should match hostname in DNS SAN', async () => {
-          const result = checkServerIdentity('foo.example.com', {
+          const result = checkServerIdentity('foo.example.com', fakeCert({
             subject: { CN: 'wrong.com' },
             subjectaltname: 'DNS:foo.example.com',
-          } as any);
+          }));
           expect(result).toBeUndefined();
         });
 
         await it('SAN takes precedence over CN', async () => {
           // When SANs are present, CN should be ignored
-          const err = checkServerIdentity('wrong.com', {
+          const err = checkServerIdentity('wrong.com', fakeCert({
             subject: { CN: 'wrong.com' },
             subjectaltname: 'DNS:right.com',
-          } as any);
+          }));
           expect(err instanceof Error).toBe(true);
         });
 
         await it('should handle multiple DNS SANs', async () => {
-          const result = checkServerIdentity('b.com', {
+          const result = checkServerIdentity('b.com', fakeCert({
             subject: { CN: 'a.com' },
             subjectaltname: 'DNS:a.com, DNS:b.com',
-          } as any);
+          }));
           expect(result).toBeUndefined();
         });
 
         await it('should fail when hostname not in any DNS SAN', async () => {
-          const err = checkServerIdentity('c.com', {
+          const err = checkServerIdentity('c.com', fakeCert({
             subject: { CN: 'c.com' },
             subjectaltname: 'DNS:a.com, DNS:b.com',
-          } as any);
+          }));
           expect(err instanceof Error).toBe(true);
         });
 
         await it('should match wildcard DNS SAN', async () => {
-          const result = checkServerIdentity('bar.example.com', {
+          const result = checkServerIdentity('bar.example.com', fakeCert({
             subject: { CN: 'wrong.com' },
             subjectaltname: 'DNS:*.example.com',
-          } as any);
+          }));
           expect(result).toBeUndefined();
         });
 
         await it('should handle mixed DNS and IP SANs', async () => {
-          const result = checkServerIdentity('example.com', {
+          const result = checkServerIdentity('example.com', fakeCert({
             subject: {},
             subjectaltname: 'DNS:example.com, IP Address:1.2.3.4',
-          } as any);
+          }));
           expect(result).toBeUndefined();
         });
 
         await it('should handle DNS SAN with trailing whitespace', async () => {
-          const result = checkServerIdentity('example.com', {
+          const result = checkServerIdentity('example.com', fakeCert({
             subject: {},
             subjectaltname: 'DNS:example.com ',
-          } as any);
+          }));
           // May or may not match depending on trimming
           expect(result === undefined || result instanceof Error).toBe(true);
         });
@@ -500,57 +523,57 @@ export default async () => {
       // --- IP address matching ---
       await describe('IP address matching', async () => {
         await it('should match IPv4 in IP Address SAN', async () => {
-          const result = checkServerIdentity('8.8.8.8', {
+          const result = checkServerIdentity('8.8.8.8', fakeCert({
             subject: { CN: '8.8.8.8' },
             subjectaltname: 'IP Address:8.8.8.8',
-          } as any);
+          }));
           expect(result).toBeUndefined();
         });
 
         await it('should fail IPv4 not in IP Address SAN', async () => {
-          const err = checkServerIdentity('8.8.4.4', {
+          const err = checkServerIdentity('8.8.4.4', fakeCert({
             subject: { CN: '8.8.4.4' },
             subjectaltname: 'IP Address:8.8.8.8',
-          } as any);
+          }));
           expect(err instanceof Error).toBe(true);
         });
 
         await it('should fail IPv4 with only CN (no SAN IP entry)', async () => {
-          const err = checkServerIdentity('8.8.8.8', {
+          const err = checkServerIdentity('8.8.8.8', fakeCert({
             subject: { CN: '8.8.8.8' },
-          } as any);
+          }));
           expect(err instanceof Error).toBe(true);
         });
 
         await it('should match multiple IP addresses in SAN', async () => {
-          const result = checkServerIdentity('1.2.3.4', {
+          const result = checkServerIdentity('1.2.3.4', fakeCert({
             subject: {},
             subjectaltname: 'IP Address:1.2.3.4, IP Address:5.6.7.8',
-          } as any);
+          }));
           expect(result).toBeUndefined();
         });
 
         await it('should match second IP in SAN', async () => {
-          const result = checkServerIdentity('5.6.7.8', {
+          const result = checkServerIdentity('5.6.7.8', fakeCert({
             subject: {},
             subjectaltname: 'IP Address:1.2.3.4, IP Address:5.6.7.8',
-          } as any);
+          }));
           expect(result).toBeUndefined();
         });
 
         await it('should handle IPv6 in IP Address SAN', async () => {
-          const result = checkServerIdentity('::1', {
+          const result = checkServerIdentity('::1', fakeCert({
             subject: {},
             subjectaltname: 'IP Address:::1',
-          } as any);
+          }));
           expect(result).toBeUndefined();
         });
 
         await it('should fail IPv4 in DNS SAN (IP should use IP Address SAN)', async () => {
-          const err = checkServerIdentity('1.2.3.4', {
+          const err = checkServerIdentity('1.2.3.4', fakeCert({
             subject: {},
             subjectaltname: 'DNS:1.2.3.4',
-          } as any);
+          }));
           expect(err instanceof Error).toBe(true);
         });
       });
@@ -558,33 +581,33 @@ export default async () => {
       // --- Error object properties ---
       await describe('error properties', async () => {
         await it('should have reason property on error', async () => {
-          const err = checkServerIdentity('a.com', { subject: { CN: 'b.com' } } as any) as any;
+          const err = checkServerIdentity('a.com', fakeCert({ subject: { CN: 'b.com' } }));
           expect(err instanceof Error).toBe(true);
-          expect(typeof err.reason).toBe('string');
+          expect(typeof (err as { reason?: string }).reason).toBe('string');
         });
 
         await it('should have host property on error', async () => {
-          const err = checkServerIdentity('a.com', { subject: { CN: 'b.com' } } as any) as any;
-          expect(err.host).toBe('a.com');
+          const err = checkServerIdentity('a.com', fakeCert({ subject: { CN: 'b.com' } }));
+          expect((err as { host?: string }).host).toBe('a.com');
         });
 
         await it('should have cert property on error', async () => {
-          const cert = { subject: { CN: 'b.com' } } as any;
-          const err = checkServerIdentity('a.com', cert) as any;
-          expect(err.cert).toBe(cert);
+          const cert = fakeCert({ subject: { CN: 'b.com' } });
+          const err = checkServerIdentity('a.com', cert);
+          expect((err as { cert?: unknown } | undefined)?.cert).toBe(cert);
         });
 
         await it('error message should contain hostname for CN mismatch', async () => {
-          const err = checkServerIdentity('a.com', { subject: { CN: 'b.com' } } as any);
+          const err = checkServerIdentity('a.com', fakeCert({ subject: { CN: 'b.com' } }));
           expect(err instanceof Error).toBe(true);
           expect((err as Error).message).toContain('a.com');
         });
 
         await it('error message should contain IP for IP mismatch', async () => {
-          const err = checkServerIdentity('8.8.8.8', {
+          const err = checkServerIdentity('8.8.8.8', fakeCert({
             subject: {},
             subjectaltname: 'IP Address:1.2.3.4',
-          } as any);
+          }));
           expect(err instanceof Error).toBe(true);
           expect((err as Error).message).toContain('8.8.8.8');
         });
@@ -593,64 +616,64 @@ export default async () => {
       // --- Edge cases ---
       await describe('edge cases', async () => {
         await it('should return error when cert has no subject and no altnames', async () => {
-          const err = checkServerIdentity('a.com', {} as any);
+          const err = checkServerIdentity('a.com', fakeCert({}));
           expect(err instanceof Error).toBe(true);
           expect((err as Error).message).toContain('DNS');
         });
 
         await it('should handle false-y host values', async () => {
-          const err = checkServerIdentity(false as unknown as string, {
+          const err = checkServerIdentity(false as unknown as string, fakeCert({
             subject: { CN: 'a.com' },
-          } as any);
+          }));
           expect(err instanceof Error).toBe(true);
         });
 
         await it('should handle empty string hostname', async () => {
-          const err = checkServerIdentity('', { subject: { CN: 'a.com' } } as any);
+          const err = checkServerIdentity('', fakeCert({ subject: { CN: 'a.com' } }));
           expect(err instanceof Error).toBe(true);
         });
 
         await it('should handle empty CN', async () => {
-          const err = checkServerIdentity('a.com', { subject: { CN: '' } } as any);
+          const err = checkServerIdentity('a.com', fakeCert({ subject: { CN: '' } }));
           expect(err instanceof Error).toBe(true);
         });
 
         await it('should handle undefined CN', async () => {
-          const err = checkServerIdentity('a.com', { subject: {} } as any);
+          const err = checkServerIdentity('a.com', fakeCert({ subject: {} }));
           expect(err instanceof Error).toBe(true);
         });
 
         await it('should handle empty subjectaltname string', async () => {
-          const err = checkServerIdentity('a.com', {
+          const err = checkServerIdentity('a.com', fakeCert({
             subject: { CN: 'a.com' },
             subjectaltname: '',
-          } as any);
+          }));
           // Empty altname means CN fallback
           expect(err === undefined || err instanceof Error).toBe(true);
         });
 
         await it('should handle numeric hostname as string', async () => {
-          const result = checkServerIdentity('127.0.0.1', {
+          const result = checkServerIdentity('127.0.0.1', fakeCert({
             subject: {},
             subjectaltname: 'IP Address:127.0.0.1',
-          } as any);
+          }));
           expect(result).toBeUndefined();
         });
 
         await it('should handle cert with only URI SAN (no DNS, no IP)', async () => {
-          const err = checkServerIdentity('a.com', {
+          const err = checkServerIdentity('a.com', fakeCert({
             subject: {},
             subjectaltname: 'URI:https://a.com',
-          } as any);
+          }));
           // URI SANs don't count for hostname verification
           expect(err instanceof Error).toBe(true);
         });
 
         await it('should handle cert with email SAN only', async () => {
-          const err = checkServerIdentity('a.com', {
+          const err = checkServerIdentity('a.com', fakeCert({
             subject: {},
             subjectaltname: 'email:admin@a.com',
-          } as any);
+          }));
           expect(err instanceof Error).toBe(true);
         });
       });