@tak-ps/node-tak 12.24.0 → 12.26.0

package/test/certificate.test.ts

@@ -0,0 +1,339 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { Readable } from 'node:stream';
+import { Client } from 'undici';
+import type { Dispatcher } from 'undici';
+import TAKAPI from '../lib/api.js';
+import { APIAuthCertificate } from '../lib/auth.js';
+
+type RequestArgs = Parameters<Client['request']>[0];
+
+function mockResponse(statusCode: number, contentType: string, body: string | Buffer): Dispatcher.ResponseData {
+    return {
+        statusCode,
+        headers: { 'content-type': contentType },
+        body: Readable.from([Buffer.from(body)]),
+        trailers: {}
+    } as unknown as Dispatcher.ResponseData;
+}
+
+// Self-signed test certificate: O=CO-TAK, OU=WILDFIRE, CN=alice@example.com, expires 2036-08-22
+const FIXTURE_PEM = `-----BEGIN CERTIFICATE-----
+MIIB1TCCAXugAwIBAgIUHPumta9q/l2whKqG1nGD9pJ/uogwCgYIKoZIzj0EAwIw
+QDEPMA0GA1UECgwGQ08tVEFLMREwDwYDVQQLDAhXSUxERklSRTEaMBgGA1UEAwwR
+YWxpY2VAZXhhbXBsZS5jb20wHhcNMjYwODI1MDEwNTQxWhcNMzYwODIyMDEwNTQx
+WjBAMQ8wDQYDVQQKDAZDTy1UQUsxETAPBgNVBAsMCFdJTERGSVJFMRowGAYDVQQD
+DBFhbGljZUBleGFtcGxlLmNvbTBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABB45
+OnCT2nVQVxlgKDLttbhLW9Yjs2/elFjAZkil+iI0QLM+vtRjdoCdI+NhADggvJ65
++++JRYr8Kv2zwv2joSKjUzBRMB0GA1UdDgQWBBS8Depzqkj88/9GNHWY8GmyreFB
+VTAfBgNVHSMEGDAWgBS8Depzqkj88/9GNHWY8GmyreFBVTAPBgNVHRMBAf8EBTAD
+AQH/MAoGCCqGSM49BAMCA0gAMEUCIQCU1mg7e/Eu4A84SemDc0bIQHTnM9aVP8h1
+LaburcgKWwIgYeKSRCQGrM1cEhJQbqJC6UWpJUGxGcclcMzGjqx7WpQ=
+-----END CERTIFICATE-----`;
+const FIXTURE_FINGERPRINT = '37:CA:5A:CD:2E:AC:F5:41:09:4B:DE:21:34:9F:A8:83:C4:43:20:71:7E:7F:CC:EC:97:2C:9E:AE:E9:5F:83:40';
+const GET_PATH = `/Marti/api/certadmin/cert/${FIXTURE_FINGERPRINT}`;
+const LIST_PATH = '/Marti/api/certadmin/cert?username=alice%40example.com';
+
+function certList(certs: object[]): string {
+    return JSON.stringify({ version: '3', type: 'TakCert', data: certs, nodeId: 'node' });
+}
+
+function certItem(cert: object): string {
+    return JSON.stringify({ version: '3', type: 'TakCert', data: cert, nodeId: 'node' });
+}
+
+// Tomcat's default page for response.sendError(500) - what the TAK Server
+// returns from getCertificate() when the hash is unknown
+const TOMCAT_500 = '<!doctype html><html lang="en"><head><title>HTTP Status 500 – Internal Server Error</title></head><body><h1>HTTP Status 500 – Internal Server Error</h1></body></html>';
+
+async function collect(stream: Readable): Promise<Buffer> {
+    const chunks: Buffer[] = [];
+    for await (const chunk of stream) chunks.push(Buffer.from(chunk));
+    return Buffer.concat(chunks);
+}
+
+/**
+ * Install a path-keyed mock; returns the list of paths requested in order
+ */
+function mockRoutes(routes: Record<string, () => Dispatcher.ResponseData>): { paths: string[]; restore: () => void } {
+    const originalRequest = Client.prototype.request;
+    const paths: string[] = [];
+
+    Client.prototype.request = async function(opts: RequestArgs): Promise<Dispatcher.ResponseData> {
+        const path = String(opts.path);
+        paths.push(path);
+        const route = routes[path];
+        if (!route) throw new Error(`Unexpected request: ${opts.method ?? 'GET'} ${path}`);
+        return route();
+    };
+
+    return { paths, restore: () => { Client.prototype.request = originalRequest; } };
+}
+
+function api(): TAKAPI {
+    return new TAKAPI(new URL('https://tak.example.com'), new APIAuthCertificate('cert', 'key'));
+}
+
+test('Certificate.listActive requests the active certificate list', async () => {
+    const mock = mockRoutes({
+        '/Marti/api/certadmin/cert/active': () => mockResponse(200, 'application/json', certList([{ id: 1, hash: 'abc', userDn: 'alice' }]))
+    });
+
+    try {
+        const res = await api().Certificate.listActive();
+
+        assert.deepEqual(mock.paths, ['/Marti/api/certadmin/cert/active']);
+        assert.equal(res.data.length, 1);
+        assert.equal(res.data[0].hash, 'abc');
+    } finally {
+        mock.restore();
+    }
+});
+
+test('Certificate.validate resolves a known certificate with a single get(hash) call', async () => {
+    const mock = mockRoutes({
+        [GET_PATH]: () => mockResponse(200, 'application/json', certItem({ id: 2, hash: FIXTURE_FINGERPRINT, userDn: 'alice@example.com' }))
+    });
+
+    try {
+        const res = await api().Certificate.validate(FIXTURE_PEM);
+
+        assert.deepEqual(mock.paths, [GET_PATH]);
+        assert.equal(res.fingerprint, FIXTURE_FINGERPRINT);
+        assert.equal(res.username, 'alice@example.com');
+        assert.equal(res.expired, false);
+        assert.equal(res.known, true);
+        assert.equal(res.revoked, false);
+        assert.equal(res.revocationDate, undefined);
+        assert.equal(res.valid, true);
+        assert.equal(res.certificate?.id, 2);
+    } finally {
+        mock.restore();
+    }
+});
+
+test('Certificate.validate reports a revoked certificate', async () => {
+    const mock = mockRoutes({
+        [GET_PATH]: () => mockResponse(200, 'application/json', certItem({ id: 2, hash: FIXTURE_FINGERPRINT, userDn: 'alice@example.com', revocationDate: '2026-08-24T21:00:00.000Z' }))
+    });
+
+    try {
+        const res = await api().Certificate.validate(FIXTURE_PEM);
+
+        assert.equal(res.known, true);
+        assert.equal(res.revoked, true);
+        assert.equal(res.revocationDate, '2026-08-24T21:00:00.000Z');
+        assert.equal(res.expired, false);
+        assert.equal(res.valid, false);
+    } finally {
+        mock.restore();
+    }
+});
+
+test('Certificate.validate falls back to the user list when get(hash) answers 500 and matches case-insensitively', async () => {
+    const mock = mockRoutes({
+        [GET_PATH]: () => mockResponse(500, 'text/html', TOMCAT_500),
+        [LIST_PATH]: () => mockResponse(200, 'application/json', certList([
+            { id: 1, hash: 'AA:BB', userDn: 'alice@example.com', revocationDate: '2026-01-01T00:00:00.000Z' },
+            { id: 2, hash: FIXTURE_FINGERPRINT.toLowerCase(), userDn: 'alice@example.com' }
+        ]))
+    });
+
+    try {
+        const res = await api().Certificate.validate(FIXTURE_PEM);
+
+        assert.deepEqual(mock.paths, [GET_PATH, LIST_PATH]);
+        assert.equal(res.known, true);
+        assert.equal(res.revoked, false);
+        assert.equal(res.valid, true);
+        assert.equal(res.certificate?.id, 2);
+    } finally {
+        mock.restore();
+    }
+});
+
+test('Certificate.validate reports an unknown certificate as not revoked but not known', async () => {
+    const mock = mockRoutes({
+        [GET_PATH]: () => mockResponse(500, 'text/html', TOMCAT_500),
+        [LIST_PATH]: () => mockResponse(200, 'application/json', certList([]))
+    });
+
+    try {
+        const res = await api().Certificate.validate(FIXTURE_PEM);
+
+        assert.deepEqual(mock.paths, [GET_PATH, LIST_PATH]);
+        assert.equal(res.known, false);
+        assert.equal(res.revoked, false);
+        assert.equal(res.certificate, undefined);
+        assert.equal(res.valid, true);
+    } finally {
+        mock.restore();
+    }
+});
+
+test('Certificate.validate rethrows non-500 failures from get(hash) without consulting the list', async () => {
+    const mock = mockRoutes({
+        [GET_PATH]: () => mockResponse(403, 'text/plain', 'Forbidden')
+    });
+
+    try {
+        await assert.rejects(() => api().Certificate.validate(FIXTURE_PEM), (err: unknown) => {
+            assert.equal((err as { status?: number }).status, 403);
+            return true;
+        });
+        assert.deepEqual(mock.paths, [GET_PATH]);
+    } finally {
+        mock.restore();
+    }
+});
+
+test('Certificate.validate evaluates expiry locally against the supplied clock', async () => {
+    const mock = mockRoutes({
+        [GET_PATH]: () => mockResponse(200, 'application/json', certItem({ id: 2, hash: FIXTURE_FINGERPRINT, userDn: 'alice@example.com' }))
+    });
+
+    try {
+        const res = await api().Certificate.validate(FIXTURE_PEM, { now: new Date('2040-01-01T00:00:00Z') });
+
+        assert.equal(res.expired, true);
+        assert.equal(res.revoked, false);
+        assert.equal(res.valid, false);
+    } finally {
+        mock.restore();
+    }
+});
+
+test('Certificate.validate rejects a PEM that is not a certificate', async () => {
+    await assert.rejects(() => api().Certificate.validate('not a certificate'));
+});
+
+test('Certificate.probe reports accepted credentials with the server version', async () => {
+    const mock = mockRoutes({
+        '/Marti/api/version': () => mockResponse(200, 'text/plain', 'TAK Server 5.4-RELEASE-1\n')
+    });
+
+    try {
+        const res = await api().Certificate.probe();
+
+        assert.deepEqual(mock.paths, ['/Marti/api/version']);
+        assert.deepEqual(res, { accepted: true, version: 'TAK Server 5.4-RELEASE-1' });
+    } finally {
+        mock.restore();
+    }
+});
+
+test('Certificate.probe classifies a RevokedException error page as revoked', async () => {
+    const mock = mockRoutes({
+        '/Marti/api/version': () => mockResponse(500, 'text/html', [
+            '<!doctype html><html lang="en"><head><title>HTTP Status 500 – Internal Server Error</title></head><body>',
+            '<h1>HTTP Status 500 – Internal Server Error</h1><p><b>Type</b> Exception Report</p>',
+            '<p><b>Message</b> Exception performing TAK Server authentication</p>',
+            '<p><b>Exception</b></p><pre>org.springframework.security.authentication.BadCredentialsException: Exception performing TAK Server authentication</pre>',
+            '<p><b>Root Cause</b></p><pre>com.bbn.marti.remote.exception.RevokedException: Attempt to use revoked certificate : CN=alice@example.com,OU=WILDFIRE,O=CO-TAK</pre>',
+            '</body></html>'
+        ].join(''))
+    });
+
+    try {
+        const res = await api().Certificate.probe();
+
+        assert.equal(res.accepted, false);
+        assert.equal(res.reason, 'revoked');
+        assert.ok(res.message);
+    } finally {
+        mock.restore();
+    }
+});
+
+test('Certificate.probe classifies a BadCredentialsException without a revocation cause as rejected', async () => {
+    const mock = mockRoutes({
+        '/Marti/api/version': () => mockResponse(500, 'text/plain', 'org.springframework.security.authentication.BadCredentialsException: Exception performing TAK Server authentication')
+    });
+
+    try {
+        const res = await api().Certificate.probe();
+
+        assert.equal(res.accepted, false);
+        assert.equal(res.reason, 'rejected');
+    } finally {
+        mock.restore();
+    }
+});
+
+test('Certificate.probe classifies a TLS handshake failure as tls', async () => {
+    const originalRequest = Client.prototype.request;
+
+    Client.prototype.request = async function(): Promise<Dispatcher.ResponseData> {
+        const err = new Error('fetch failed') as Error & { cause?: Error };
+        err.cause = Object.assign(new Error('write EPROTO SSL routines:ssl3_read_bytes:sslv3 alert bad certificate'), { code: 'EPROTO' });
+        throw err;
+    };
+
+    try {
+        const res = await api().Certificate.probe();
+
+        assert.equal(res.accepted, false);
+        assert.equal(res.reason, 'tls');
+        assert.match(res.message ?? '', /EPROTO/);
+    } finally {
+        Client.prototype.request = originalRequest;
+    }
+});
+
+test('Certificate.probe rethrows errors that are not authentication failures', async () => {
+    const mock = mockRoutes({
+        '/Marti/api/version': () => mockResponse(503, 'text/plain', 'Service Unavailable')
+    });
+
+    try {
+        await assert.rejects(() => api().Certificate.probe(), (err: unknown) => {
+            assert.equal((err as { status?: number }).status, 503);
+            return true;
+        });
+    } finally {
+        mock.restore();
+    }
+});
+
+test('Certificate.downloadIds streams the ZIP archive for the given IDs', async () => {
+    const mock = mockRoutes({
+        '/Marti/api/certadmin/cert/download/1,2,3': () => mockResponse(200, 'application/zip', Buffer.from('zip-bytes'))
+    });
+
+    try {
+        const body = await collect(await api().Certificate.downloadIds([1, '2', 3]));
+
+        assert.deepEqual(mock.paths, ['/Marti/api/certadmin/cert/download/1,2,3']);
+        assert.equal(body.toString(), 'zip-bytes');
+    } finally {
+        mock.restore();
+    }
+});
+
+test('Certificate.downloadIds rejects an empty ID list without a request', async () => {
+    const mock = mockRoutes({});
+
+    try {
+        await assert.rejects(() => api().Certificate.downloadIds([]), /At least one ID must be provided/);
+        assert.deepEqual(mock.paths, []);
+    } finally {
+        mock.restore();
+    }
+});
+
+test('Certificate.downloadIds throws on a TAK Server error instead of streaming the error page', async () => {
+    const mock = mockRoutes({
+        '/Marti/api/certadmin/cert/download/1': () => mockResponse(500, 'text/plain', 'exception in downloadCertificates!')
+    });
+
+    try {
+        await assert.rejects(() => api().Certificate.downloadIds([1]), (err: unknown) => {
+            assert.ok(err instanceof Error);
+            assert.equal((err as { status?: number }).status, 500);
+            assert.match(err.message, /downloadCertificates/);
+            return true;
+        });
+    } finally {
+        mock.restore();
+    }
+});

package/test/html-error.test.ts

@@ -0,0 +1,139 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import Err from '@openaddresses/batch-error';
+import {
+    TAKServerError,
+    isHTML,
+    parseHTMLError,
+    summarizeHTMLError,
+    formatHTMLError,
+} from '../lib/utils/html-error.js';
+
+const TOMCAT = `<!doctype html><html lang="en"><head><title>HTTP Status 500 &ndash; Internal Server Error</title><style type="text/css">body {font-family:Tahoma,Arial,sans-serif;} h1, h2, h3, b {color:white;background-color:#525D76;} h1 {font-size:22px;} h2 {font-size:16px;} h3 {font-size:14px;} p {font-size:12px;} a {color:black;} .line {height:1px;background-color:#525D76;border:none;}</style></head><body><h1>HTTP Status 500 &ndash; Internal Server Error</h1><hr class="line" /><p><b>Type</b> Exception Report</p><p><b>Message</b> Exception performing TAK Server authentication</p><p><b>Description</b> The server encountered an unexpected condition that prevented it from fulfilling the request.</p><p><b>Exception</b></p><pre>org.springframework.security.authentication.BadCredentialsException: Exception performing TAK Server authentication
+\tcom.bbn.marti.util.spring.TakAuthenticationProvider.authenticateCore(TakAuthenticationProvider.java:190)
+\tcom.bbn.marti.util.spring.TakAuthenticationProvider.authenticate(TakAuthenticationProvider.java:244)
+\torg.springframework.security.authentication.ProviderManager.authenticate(ProviderManager.java:181)
+</pre><p><b>Note</b> The full stack trace of the root cause is available in the server logs.</p><hr class="line" /><h3>Apache Tomcat/9.0.86</h3></body></html>`;
+
+test('html-error: isHTML', () => {
+    assert.equal(isHTML(TOMCAT), true);
+    assert.equal(isHTML('  <html><body>x</body></html>'), true);
+    assert.equal(isHTML('<h1>HTTP Status 404 – Not Found</h1>'), true);
+    assert.equal(isHTML('{"message":"nope"}'), false);
+    assert.equal(isHTML('Plain text failure'), false);
+    assert.equal(isHTML(null), false);
+    assert.equal(isHTML({}), false);
+});
+
+test('html-error: entities are decoded', () => {
+    const parsed = parseHTMLError('<html><body><p><b>Message</b> a &ndash; b &amp; &lt;c&gt; &#39;d&#39; &#x41;</p></body></html>');
+    assert.ok(parsed);
+    assert.equal(parsed.fields.Message, 'a – b & <c> \'d\' A');
+});
+
+test('html-error: malformed HTML strips hidden blocks & unterminated tags', () => {
+    const parsed = parseHTMLError('<html><script>let a = "<b>";</script><body><STYLE>b {x:y}</STYLE><p class="x">Gateway <b>Timeout</b><script>never closed');
+    assert.ok(parsed);
+    assert.equal(parsed.text, 'Gateway Timeout');
+    assert.equal(parseHTMLError('<html><body>Broken <tag')?.text, 'Broken');
+
+    // Pathological input scales linearly (CodeQL polynomial regex finding)
+    const time = (n: number) => {
+        const big = '<html>' + '<head\t'.repeat(n) + '<'.repeat(n);
+        const start = performance.now();
+        assert.ok(parseHTMLError(big));
+        return performance.now() - start;
+    };
+    time(1000); // warm up
+    const small = time(10000);
+    const large = time(40000);
+    assert.ok(large < Math.max(small * 10, 50), `4x input took ${large}ms vs ${small}ms`);
+});
+
+test('html-error: TAKServerError from non-HTML body', () => {
+    const err = new TAKServerError(502, 'upstream <b>down</b>');
+    assert.equal(err.message, 'upstream down');
+    assert.equal(err.details, 'upstream down');
+});
+
+test('html-error: malformed HTML falls back to visible text', () => {
+    const parsed = parseHTMLError('<html><head><style>b {x:y}</style></head><body><p>Bad Gateway<br>upstream unavailable</body></html>');
+    assert.ok(parsed);
+    assert.equal(parsed.title, undefined);
+    assert.equal(parsed.text, 'Bad Gateway upstream unavailable');
+    assert.equal(summarizeHTMLError(parsed, 502), 'Bad Gateway upstream unavailable');
+});
+
+test('html-error: parseHTMLError - Tomcat Exception Report', () => {
+    const parsed = parseHTMLError(TOMCAT);
+    assert.ok(parsed);
+
+    assert.equal(parsed.title, 'HTTP Status 500 – Internal Server Error');
+    assert.deepEqual(parsed.fields, {
+        Type: 'Exception Report',
+        Message: 'Exception performing TAK Server authentication',
+        Description: 'The server encountered an unexpected condition that prevented it from fulfilling the request.',
+        Note: 'The full stack trace of the root cause is available in the server logs.',
+    });
+
+    assert.ok(parsed.exception);
+    assert.ok(parsed.exception.startsWith('org.springframework.security.authentication.BadCredentialsException: Exception performing TAK Server authentication\n'));
+    assert.ok(parsed.exception.includes('TakAuthenticationProvider.java:244'));
+    assert.ok(!parsed.exception.endsWith('\n'));
+
+    // Styles & exception body are excluded from the text fallback
+    assert.ok(!parsed.text.includes('font-family'));
+    assert.ok(!parsed.text.includes('TakAuthenticationProvider'));
+    assert.ok(parsed.text.includes('Apache Tomcat/9.0.86'));
+
+    assert.equal(summarizeHTMLError(parsed), 'Exception performing TAK Server authentication');
+
+    const formatted = formatHTMLError(parsed);
+    assert.equal(formatted.split('\n').slice(0, 6).join('\n'), [
+        'HTTP Status 500 – Internal Server Error',
+        'Type: Exception Report',
+        'Message: Exception performing TAK Server authentication',
+        'Description: The server encountered an unexpected condition that prevented it from fulfilling the request.',
+        'Note: The full stack trace of the root cause is available in the server logs.',
+        '',
+    ].join('\n'));
+    assert.ok(formatted.endsWith('ProviderManager.authenticate(ProviderManager.java:181)'));
+});
+
+test('html-error: parseHTMLError - status page without Message', () => {
+    const parsed = parseHTMLError('<!doctype html><html><head><title>HTTP Status 404 &ndash; Not Found</title></head><body><h1>HTTP Status 404 &ndash; Not Found</h1><p><b>Type</b> Status Report</p><p><b>Description</b> The origin server did not find a current representation for the target resource.</p></body></html>');
+    assert.ok(parsed);
+    assert.equal(summarizeHTMLError(parsed, 404), 'The origin server did not find a current representation for the target resource.');
+});
+
+test('html-error: parseHTMLError - exception only', () => {
+    const parsed = parseHTMLError('<html><body><pre>java.lang.IllegalStateException: Mission already exists</pre></body></html>');
+    assert.ok(parsed);
+    assert.equal(summarizeHTMLError(parsed), 'Mission already exists');
+    assert.equal(formatHTMLError(parsed), 'java.lang.IllegalStateException: Mission already exists');
+});
+
+test('html-error: parseHTMLError - unstructured HTML', () => {
+    const parsed = parseHTMLError('<html><body><div>Service Unavailable</div></body></html>');
+    assert.ok(parsed);
+    assert.equal(parsed.title, undefined);
+    assert.equal(summarizeHTMLError(parsed, 503), 'Service Unavailable');
+    assert.equal(formatHTMLError(parsed), 'Service Unavailable');
+
+    assert.equal(parseHTMLError('not html'), null);
+});
+
+test('html-error: TAKServerError', () => {
+    const err = new TAKServerError(500, TOMCAT);
+
+    assert.ok(err instanceof Err);
+    assert.ok(err instanceof Error);
+    assert.equal(err.name, 'PublicError');
+    assert.equal(err.status, 500);
+    assert.equal(err.message, 'Exception performing TAK Server authentication');
+    assert.equal(err.safe, 'Exception performing TAK Server authentication');
+    assert.ok(err.details.startsWith('HTTP Status 500 – Internal Server Error\nType: Exception Report\n'));
+    assert.ok(err.details.includes('BadCredentialsException'));
+    assert.equal(err.html, TOMCAT);
+    assert.equal(err.parsed.fields.Type, 'Exception Report');
+});