@jsenv/https-local 3.0.7 → 3.1.1

package/src/certificate_authority.js

@@ -1,17 +1,16 @@
-import { readFile, writeFile, removeEntry } from "@jsenv/filesystem"
-import { UNICODE, createLogger, createDetailedMessage } from "@jsenv/log"
-
-import { forge } from "./internal/forge.js"
-import { getAuthorityFileInfos } from "./internal/authority_file_infos.js"
-import { attributeDescriptionFromAttributeArray } from "./internal/certificate_data_converter.js"
+import { readFile, removeEntry, writeFile } from "@jsenv/filesystem";
+import { UNICODE, createDetailedMessage, createLogger } from "@jsenv/humanize";
+import { getAuthorityFileInfos } from "./internal/authority_file_infos.js";
+import { attributeDescriptionFromAttributeArray } from "./internal/certificate_data_converter.js";
+import { createAuthorityRootCertificate } from "./internal/certificate_generator.js";
+import { forge } from "./internal/forge.js";
+import { importPlatformMethods } from "./internal/platform.js";
 import {
-  formatTimeDelta,
   formatDuration,
-} from "./internal/validity_formatting.js"
-import { createAuthorityRootCertificate } from "./internal/certificate_generator.js"
-import { importPlatformMethods } from "./internal/platform.js"
-import { jsenvParameters } from "./jsenvParameters.js"
-import { verifyRootCertificateValidityDuration } from "./validity_duration.js"
+  formatTimeDelta,
+} from "./internal/validity_formatting.js";
+import { jsenvParameters } from "./jsenvParameters.js";
+import { verifyRootCertificateValidityDuration } from "./validity_duration.js";
 
 export const installCertificateAuthority = async ({
   logLevel,
@@ -29,80 +28,80 @@ export const installCertificateAuthority = async ({
   if (typeof certificateCommonName !== "string") {
     throw new TypeError(
       `certificateCommonName must be a string but received ${certificateCommonName}`,
-    )
+    );
   }
   if (typeof certificateValidityDurationInMs !== "number") {
     throw new TypeError(
       `certificateValidityDurationInMs must be a number but received ${certificateValidityDurationInMs}`,
-    )
+    );
   }
   if (certificateValidityDurationInMs < 1) {
     throw new TypeError(
       `certificateValidityDurationInMs must be > 0 but received ${certificateValidityDurationInMs}`,
-    )
+    );
   }
 
   const validityDurationInfo = verifyRootCertificateValidityDuration(
     certificateValidityDurationInMs,
-  )
+  );
   if (!validityDurationInfo.ok) {
-    certificateValidityDurationInMs = validityDurationInfo.maxAllowedValue
+    certificateValidityDurationInMs = validityDurationInfo.maxAllowedValue;
     logger.warn(
       createDetailedMessage(validityDurationInfo.message, {
         details: validityDurationInfo.details,
       }),
-    )
+    );
   }
 
   const {
     authorityJsonFileInfo,
     rootCertificateFileInfo,
     rootCertificatePrivateKeyFileInfo,
-  } = getAuthorityFileInfos()
-  const authorityJsonFileUrl = authorityJsonFileInfo.url
-  const rootCertificateFileUrl = rootCertificateFileInfo.url
-  const rootPrivateKeyFileUrl = rootCertificatePrivateKeyFileInfo.url
-  const platformMethods = await importPlatformMethods()
+  } = getAuthorityFileInfos();
+  const authorityJsonFileUrl = authorityJsonFileInfo.url;
+  const rootCertificateFileUrl = rootCertificateFileInfo.url;
+  const rootPrivateKeyFileUrl = rootCertificatePrivateKeyFileInfo.url;
+  const platformMethods = await importPlatformMethods();
 
   const generateRootCertificate = async () => {
     logger.info(
       `Generating authority root certificate with a validity of ${formatDuration(
         certificateValidityDurationInMs,
       )}...`,
-    )
+    );
     const { rootCertificateForgeObject, rootCertificatePrivateKeyForgeObject } =
       await createAuthorityRootCertificate({
         logger,
         commonName: certificateCommonName,
         validityDurationInMs: certificateValidityDurationInMs,
         serialNumber: 0,
-      })
+      });
 
-    const { pki } = forge
+    const { pki } = forge;
     const rootCertificate = pemAsFileContent(
       pki.certificateToPem(rootCertificateForgeObject),
-    )
+    );
     const rootCertificatePrivateKey = pemAsFileContent(
       pki.privateKeyToPem(rootCertificatePrivateKeyForgeObject),
-    )
+    );
 
-    await writeFile(rootCertificateFileUrl, rootCertificate)
-    await writeFile(rootPrivateKeyFileUrl, rootCertificatePrivateKey)
+    await writeFile(rootCertificateFileUrl, rootCertificate);
+    await writeFile(rootPrivateKeyFileUrl, rootCertificatePrivateKey);
     await writeFile(
       authorityJsonFileUrl,
       JSON.stringify({ serialNumber: 0 }, null, "  "),
-    )
+    );
 
     logger.info(
       `${UNICODE.OK} authority root certificate written at ${rootCertificateFileInfo.path}`,
-    )
+    );
     return {
       rootCertificateForgeObject,
       rootCertificatePrivateKeyForgeObject,
       rootCertificate,
       rootCertificatePrivateKey,
-    }
-  }
+    };
+  };
 
   const generate = async () => {
     const {
@@ -110,7 +109,7 @@ export const installCertificateAuthority = async ({
       rootCertificatePrivateKeyForgeObject,
       rootCertificate,
       rootCertificatePrivateKey,
-    } = await generateRootCertificate()
+    } = await generateRootCertificate();
 
     const trustInfo = await platformMethods.executeTrustQuery({
       logger,
@@ -120,7 +119,7 @@ export const installCertificateAuthority = async ({
       certificate: rootCertificate,
       verb: tryToTrust ? "ADD_TRUST" : "CHECK_TRUST",
       NSSDynamicInstall,
-    })
+    });
 
     return {
       rootCertificateForgeObject,
@@ -129,8 +128,8 @@ export const installCertificateAuthority = async ({
       rootCertificatePrivateKey,
       rootCertificateFilePath: rootCertificateFileInfo.path,
       trustInfo,
-    }
-  }
+    };
+  };
 
   const regenerate = async () => {
     if (tryToTrust) {
@@ -140,97 +139,97 @@ export const installCertificateAuthority = async ({
         certificateFileUrl: rootCertificateFileUrl,
         certificate: rootCertificate,
         verb: "REMOVE_TRUST",
-      })
+      });
     }
-    return generate()
-  }
+    return generate();
+  };
 
-  logger.debug(`Search existing certificate authority on filesystem...`)
+  logger.debug(`Search existing certificate authority on filesystem...`);
   if (!rootCertificateFileInfo.exists) {
     logger.debug(
       `Authority root certificate is not on filesystem at ${rootCertificateFileInfo.path}`,
-    )
+    );
     logger.info(
       `${UNICODE.INFO} authority root certificate not found in filesystem`,
-    )
-    return generate()
+    );
+    return generate();
   }
   if (!rootCertificatePrivateKeyFileInfo.exists) {
     logger.debug(
       `Authority root certificate private key is not on filesystem at ${rootCertificatePrivateKeyFileInfo.path}`,
-    )
+    );
     logger.info(
       `${UNICODE.INFO} authority root certificate not found in filesystem`,
-    )
-    return generate()
+    );
+    return generate();
   }
   logger.debug(
     `found authority root certificate files at ${rootCertificateFileInfo.path} and ${rootCertificatePrivateKeyFileInfo.path}`,
-  )
-  logger.info(`${UNICODE.OK} authority root certificate found in filesystem`)
+  );
+  logger.info(`${UNICODE.OK} authority root certificate found in filesystem`);
 
   const rootCertificate = await readFile(rootCertificateFileInfo.path, {
     as: "string",
-  })
-  const { pki } = forge
-  const rootCertificateForgeObject = pki.certificateFromPem(rootCertificate)
+  });
+  const { pki } = forge;
+  const rootCertificateForgeObject = pki.certificateFromPem(rootCertificate);
 
-  logger.info(`Checking certificate validity...`)
+  logger.info(`Checking certificate validity...`);
   const rootCertificateValidityDurationInMs =
-    getCertificateValidityDurationInMs(rootCertificateForgeObject)
+    getCertificateValidityDurationInMs(rootCertificateForgeObject);
   const rootCertificateValidityRemainingMs = getCertificateRemainingMs(
     rootCertificateForgeObject,
-  )
+  );
   if (rootCertificateValidityRemainingMs < 0) {
     logger.info(
       `${UNICODE.INFO} certificate expired ${formatTimeDelta(
         rootCertificateValidityRemainingMs,
       )}`,
-    )
-    return regenerate()
+    );
+    return regenerate();
   }
   const rootCertificateValidityRemainingRatio =
-    rootCertificateValidityRemainingMs / rootCertificateValidityDurationInMs
+    rootCertificateValidityRemainingMs / rootCertificateValidityDurationInMs;
   if (rootCertificateValidityRemainingRatio < aboutToExpireRatio) {
     logger.info(
       `${UNICODE.INFO} certificate will expire ${formatTimeDelta(
         rootCertificateValidityRemainingMs,
       )}`,
-    )
-    return regenerate()
+    );
+    return regenerate();
   }
   logger.info(
     `${UNICODE.OK} certificate still valid for ${formatDuration(
       rootCertificateValidityRemainingMs,
     )}`,
-  )
+  );
 
-  logger.info(`Detect if certificate attributes have changed...`)
+  logger.info(`Detect if certificate attributes have changed...`);
   const rootCertificateDifferences = compareRootCertificateAttributes(
     rootCertificateForgeObject,
     {
       certificateCommonName,
       certificateValidityDurationInMs,
     },
-  )
+  );
   if (rootCertificateDifferences.length) {
-    const paramNames = Object.keys(rootCertificateDifferences)
+    const paramNames = Object.keys(rootCertificateDifferences);
     logger.info(
       `${UNICODE.INFO} certificate attributes are outdated: ${paramNames}`,
-    )
-    return regenerate()
+    );
+    return regenerate();
   }
-  logger.info(`${UNICODE.OK} certificate attributes are the same`)
+  logger.info(`${UNICODE.OK} certificate attributes are the same`);
 
   const rootCertificatePrivateKey = await readFile(
     rootCertificatePrivateKeyFileInfo.path,
     {
       as: "string",
     },
-  )
+  );
   const rootCertificatePrivateKeyForgeObject = pki.privateKeyFromPem(
     rootCertificatePrivateKey,
-  )
+  );
   const trustInfo = await platformMethods.executeTrustQuery({
     logger,
     certificateCommonName,
@@ -238,7 +237,7 @@ export const installCertificateAuthority = async ({
     certificate: rootCertificate,
     verb: tryToTrust ? "ENSURE_TRUST" : "CHECK_TRUST",
     NSSDynamicInstall,
-  })
+  });
 
   return {
     rootCertificateForgeObject,
@@ -247,8 +246,8 @@ export const installCertificateAuthority = async ({
     rootCertificatePrivateKey,
     rootCertificateFilePath: rootCertificateFileInfo.path,
     trustInfo,
-  }
-}
+  };
+};
 
 // const getCertificateValidSinceInMs = (forgeCertificate) => {
 //   const { notBefore } = forgeCertificate.validity
@@ -258,17 +257,17 @@ export const installCertificateAuthority = async ({
 // }
 
 const getCertificateRemainingMs = (certificateForgeObject) => {
-  const { notAfter } = certificateForgeObject.validity
-  const nowDate = Date.now()
-  const remainingMs = notAfter - nowDate
-  return remainingMs
-}
+  const { notAfter } = certificateForgeObject.validity;
+  const nowDate = Date.now();
+  const remainingMs = notAfter - nowDate;
+  return remainingMs;
+};
 
 const getCertificateValidityDurationInMs = (certificateForgeObject) => {
-  const { notBefore, notAfter } = certificateForgeObject.validity
-  const validityDurationInMs = notAfter - notBefore
-  return validityDurationInMs
-}
+  const { notBefore, notAfter } = certificateForgeObject.validity;
+  const validityDurationInMs = notAfter - notBefore;
+  return validityDurationInMs;
+};
 
 const compareRootCertificateAttributes = (
   rootCertificateForgeObject,
@@ -276,28 +275,28 @@ const compareRootCertificateAttributes = (
 ) => {
   const attributeDescription = attributeDescriptionFromAttributeArray(
     rootCertificateForgeObject.subject.attributes,
-  )
-  const differences = {}
+  );
+  const differences = {};
 
-  const { commonName } = attributeDescription
+  const { commonName } = attributeDescription;
   if (commonName !== certificateCommonName) {
     differences.certificateCommonName = {
       valueFromCertificate: commonName,
       valueFromParam: certificateCommonName,
-    }
+    };
   }
 
-  const { notBefore, notAfter } = rootCertificateForgeObject.validity
-  const rootCertificateValidityDurationInMs = notAfter - notBefore
+  const { notBefore, notAfter } = rootCertificateForgeObject.validity;
+  const rootCertificateValidityDurationInMs = notAfter - notBefore;
   if (rootCertificateValidityDurationInMs !== certificateValidityDurationInMs) {
     differences.rootCertificateValidityDurationInMs = {
       valueFromCertificate: rootCertificateValidityDurationInMs,
       valueFromParam: certificateValidityDurationInMs,
-    }
+    };
   }
 
-  return differences
-}
+  return differences;
+};
 
 export const uninstallCertificateAuthority = async ({
   logLevel,
@@ -308,58 +307,60 @@ export const uninstallCertificateAuthority = async ({
     authorityJsonFileInfo,
     rootCertificateFileInfo,
     rootCertificatePrivateKeyFileInfo,
-  } = getAuthorityFileInfos()
+  } = getAuthorityFileInfos();
 
-  const filesToRemove = []
+  const filesToRemove = [];
 
   if (authorityJsonFileInfo.exists) {
-    filesToRemove.push(authorityJsonFileInfo.url)
+    filesToRemove.push(authorityJsonFileInfo.url);
   }
   if (rootCertificateFileInfo.exists) {
     // first untrust the root cert file
     if (tryToUntrust) {
       const rootCertificate = await readFile(rootCertificateFileInfo.url, {
         as: "string",
-      })
-      const { pki } = forge
-      const rootCertificateForgeObject = pki.certificateFromPem(rootCertificate)
+      });
+      const { pki } = forge;
+      const rootCertificateForgeObject =
+        pki.certificateFromPem(rootCertificate);
       const rootCertificateCommonName = attributeDescriptionFromAttributeArray(
         rootCertificateForgeObject.subject.attributes,
-      ).commonName
-      const { removeCertificateFromTrustStores } = await importPlatformMethods()
+      ).commonName;
+      const { removeCertificateFromTrustStores } =
+        await importPlatformMethods();
       await removeCertificateFromTrustStores({
         logger,
         certificate: rootCertificate,
         certificateFileUrl: rootCertificateFileInfo.url,
         certificateCommonName: rootCertificateCommonName,
-      })
+      });
     }
-    filesToRemove.push(rootCertificateFileInfo.url)
+    filesToRemove.push(rootCertificateFileInfo.url);
   }
   if (rootCertificatePrivateKeyFileInfo.exists) {
-    filesToRemove.push(rootCertificatePrivateKeyFileInfo.url)
+    filesToRemove.push(rootCertificatePrivateKeyFileInfo.url);
   }
 
   if (filesToRemove.length) {
-    logger.info(`Removing certificate authority files...`)
+    logger.info(`Removing certificate authority files...`);
     await Promise.all(
       filesToRemove.map(async (file) => {
-        await removeEntry(file)
+        await removeEntry(file);
       }),
-    )
+    );
     logger.info(
       `${UNICODE.OK} certificate authority files removed from filesystem`,
-    )
+    );
   }
-}
+};
 
 const pemAsFileContent = (pem) => {
   if (process.platform === "win32") {
-    return pem
+    return pem;
   }
   // prefer \n when writing pem into files
-  return pem.replace(/\r\n/g, "\n")
-}
+  return pem.replace(/\r\n/g, "\n");
+};
 
 /*
  * The root certificate files can be "hard" to find because

package/src/certificate_request.js

@@ -1,15 +1,14 @@
-import { readFileSync } from "node:fs"
-import { writeFileSync } from "@jsenv/filesystem"
-import { UNICODE, createLogger, createDetailedMessage } from "@jsenv/log"
-
-import { forge } from "./internal/forge.js"
+import { writeFileSync } from "@jsenv/filesystem";
+import { UNICODE, createDetailedMessage, createLogger } from "@jsenv/humanize";
+import { readFileSync } from "node:fs";
+import { getAuthorityFileInfos } from "./internal/authority_file_infos.js";
+import { requestCertificateFromAuthority } from "./internal/certificate_generator.js";
+import { forge } from "./internal/forge.js";
+import { formatDuration } from "./internal/validity_formatting.js";
 import {
   createValidityDurationOfXDays,
   verifyServerCertificateValidityDuration,
-} from "./validity_duration.js"
-import { getAuthorityFileInfos } from "./internal/authority_file_infos.js"
-import { requestCertificateFromAuthority } from "./internal/certificate_generator.js"
-import { formatDuration } from "./internal/validity_formatting.js"
+} from "./validity_duration.js";
 
 export const requestCertificate = ({
   logLevel,
@@ -22,66 +21,68 @@ export const requestCertificate = ({
   if (typeof validityDurationInMs !== "number") {
     throw new TypeError(
       `validityDurationInMs must be a number but received ${validityDurationInMs}`,
-    )
+    );
   }
   if (validityDurationInMs < 1) {
     throw new TypeError(
       `validityDurationInMs must be > 0 but received ${validityDurationInMs}`,
-    )
+    );
   }
   const validityDurationInfo =
-    verifyServerCertificateValidityDuration(validityDurationInMs)
+    verifyServerCertificateValidityDuration(validityDurationInMs);
   if (!validityDurationInfo.ok) {
-    validityDurationInMs = validityDurationInfo.maxAllowedValue
+    validityDurationInMs = validityDurationInfo.maxAllowedValue;
     logger.warn(
       createDetailedMessage(validityDurationInfo.message, {
         details: validityDurationInfo.details,
       }),
-    )
+    );
   }
 
   const {
     authorityJsonFileInfo,
     rootCertificateFileInfo,
     rootCertificatePrivateKeyFileInfo,
-  } = getAuthorityFileInfos()
+  } = getAuthorityFileInfos();
   if (!rootCertificateFileInfo.exists) {
     throw new Error(
-      `Certificate authority not found, "installCertificateAuthority" must be called before "requestServerCertificate"`,
-    )
+      `Certificate authority not found, "installCertificateAuthority" must be called before "requestServerCertificate".
+--- Suggested command to run ---
+npx @jsenv/https-local install --trust`,
+    );
   }
   if (!rootCertificatePrivateKeyFileInfo.exists) {
-    throw new Error(`Cannot find authority root certificate private key`)
+    throw new Error(`Cannot find authority root certificate private key`);
   }
   if (!authorityJsonFileInfo.exists) {
-    throw new Error(`Cannot find authority json file`)
+    throw new Error(`Cannot find authority json file`);
   }
 
-  logger.debug(`Restoring certificate authority from filesystem...`)
-  const { pki } = forge
+  logger.debug(`Restoring certificate authority from filesystem...`);
+  const { pki } = forge;
   const rootCertificate = String(
     readFileSync(new URL(rootCertificateFileInfo.url)),
-  )
+  );
   const rootCertificatePrivateKey = String(
     readFileSync(new URL(rootCertificatePrivateKeyFileInfo.url)),
-  )
+  );
   const certificateAuthorityData = JSON.parse(
     String(readFileSync(new URL(authorityJsonFileInfo.url))),
-  )
-  const rootCertificateForgeObject = pki.certificateFromPem(rootCertificate)
+  );
+  const rootCertificateForgeObject = pki.certificateFromPem(rootCertificate);
   const rootCertificatePrivateKeyForgeObject = pki.privateKeyFromPem(
     rootCertificatePrivateKey,
-  )
-  logger.debug(`${UNICODE.OK} certificate authority restored from filesystem`)
+  );
+  logger.debug(`${UNICODE.OK} certificate authority restored from filesystem`);
 
   const serverCertificateSerialNumber =
-    certificateAuthorityData.serialNumber + 1
+    certificateAuthorityData.serialNumber + 1;
   writeFileSync(
     authorityJsonFileInfo.url,
     JSON.stringify({ serialNumber: serverCertificateSerialNumber }, null, "  "),
-  )
+  );
 
-  logger.debug(`Generating server certificate...`)
+  logger.debug(`Generating server certificate...`);
   const { certificateForgeObject, certificatePrivateKeyForgeObject } =
     requestCertificateFromAuthority({
       logger,
@@ -92,22 +93,22 @@ export const requestCertificate = ({
       altNames,
       commonName,
       validityDurationInMs,
-    })
-  const serverCertificate = pki.certificateToPem(certificateForgeObject)
+    });
+  const serverCertificate = pki.certificateToPem(certificateForgeObject);
   const serverCertificatePrivateKey = pki.privateKeyToPem(
     certificatePrivateKeyForgeObject,
-  )
+  );
   logger.debug(
     `${
       UNICODE.OK
     } server certificate generated, it will be valid for ${formatDuration(
       validityDurationInMs,
     )}`,
-  )
+  );
 
   return {
     certificate: serverCertificate,
     privateKey: serverCertificatePrivateKey,
     rootCertificateFilePath: rootCertificateFileInfo.path,
-  }
-}
+  };
+};