@tak-ps/node-tak 12.25.0 → 12.26.0

package/CHANGELOG.md

@@ -12,6 +12,12 @@
 
 ### Pending
 
+### v12.26.0 - 2026-08-24
+
+- :tada: Add `Certificate.listActive()` (`GET /Marti/api/certadmin/cert/active`) & `Certificate.downloadIds()` (`GET /Marti/api/certadmin/cert/download/{ids}`, returns the ZIP archive as a `Readable`)
+- :tada: Add `Certificate.validate(pem)` which evaluates expiry locally and looks up the TAK Server revocation record by SHA-256 fingerprint (the same `hash` consulted by `X509Authenticator`) via the user's certificate list, returning `expired`/`revoked`/`known`/`valid` along with the matching `certificate` record - `CertificateValidation` is exported. The record is fetched with `get(hash)` (a single cached row on the TAK Server) falling back to the user's certificate list when the server answers 500, which is how it reports an unknown hash
+- :tada: Add `Certificate.probe()` which checks whether the TAK Server accepts the API's own credentials via `GET /Marti/api/version` - the cheapest authoritative check as the X509 filter runs (and rethrows) on every request. Returns `{ accepted, version }` or `{ accepted: false, reason: 'revoked' | 'rejected' | 'tls', message }`; non-authentication errors are rethrown. `CertificateProbe` is exported
+
 ### v12.25.0 - 2026-08-24
 
 - :tada: TAK Server HTML error pages (Tomcat/Spring "Exception Report" documents) returned by the API are now parsed into a `TAKServerError` instead of the raw HTML being used as the error message - `message`/`safe` contain the human readable `Message` (falling back to `Description`, the Exception's message, the page `<title>` or the visible text) while `details` contains a plain-text breakdown (status line, labelled fields & exception trace) suitable for an "Advanced" UI section and `html` retains the unmodified page. Pages are parsed with the existing `@tak-ps/xml-js` dependency (Tomcat emits well-formed XHTML) with a visible-text fallback for malformed documents. `TAKServerError`, `parseHTMLError()`, `isHTML()`, `summarizeHTMLError()` & `formatHTMLError()` are exported

package/dist/lib/api/certificate.d.ts

@@ -1,4 +1,5 @@
 import Commands from '../commands.js';
+import { Readable } from 'node:stream';
 import type { Static } from '@sinclair/typebox';
 export declare const Certificate: import("@sinclair/typebox").TObject<{
     id: import("@sinclair/typebox").TInteger;
@@ -57,6 +58,39 @@ export declare const TAKItem_Certificate: import("@sinclair/typebox").TObject<{
     messages: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>>;
     nodeId: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
 }>;
+export declare const CertificateValidation: import("@sinclair/typebox").TObject<{
+    fingerprint: import("@sinclair/typebox").TString;
+    subject: import("@sinclair/typebox").TString;
+    username: import("@sinclair/typebox").TString;
+    validFrom: import("@sinclair/typebox").TString;
+    validTo: import("@sinclair/typebox").TString;
+    expired: import("@sinclair/typebox").TBoolean;
+    known: import("@sinclair/typebox").TBoolean;
+    revoked: import("@sinclair/typebox").TBoolean;
+    revocationDate: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+    valid: import("@sinclair/typebox").TBoolean;
+    certificate: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TObject<{
+        id: import("@sinclair/typebox").TInteger;
+        creatorDn: import("@sinclair/typebox").TString;
+        subjectDn: import("@sinclair/typebox").TString;
+        userDn: import("@sinclair/typebox").TString;
+        certificate: import("@sinclair/typebox").TString;
+        hash: import("@sinclair/typebox").TString;
+        clientUid: import("@sinclair/typebox").TString;
+        issuanceDate: import("@sinclair/typebox").TString;
+        expirationDate: import("@sinclair/typebox").TString;
+        effectiveDate: import("@sinclair/typebox").TString;
+        revocationDate: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+        token: import("@sinclair/typebox").TString;
+        serialNumber: import("@sinclair/typebox").TString;
+    }>>;
+}>;
+export declare const CertificateProbe: import("@sinclair/typebox").TObject<{
+    accepted: import("@sinclair/typebox").TBoolean;
+    version: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+    reason: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"revoked">, import("@sinclair/typebox").TLiteral<"rejected">, import("@sinclair/typebox").TLiteral<"tls">]>>;
+    message: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+}>;
 export default class CertificateCommands extends Commands {
     schema: {};
     cli(): Promise<object | string>;
@@ -66,6 +100,14 @@ export default class CertificateCommands extends Commands {
      * {@link https://docs.tak.gov/api/takserver/redoc#tag/cert-manager-admin-api/operation/getAll_1 TAK Server Docs}.
      */
     list(username?: string): Promise<Static<typeof TAKList_Certificate>>;
+    /**
+     * List Active Certificates
+     *
+     * The most recently issued certificate for each Client UID / User DN pair
+     *
+     * {@link https://docs.tak.gov/api/takserver/redoc#tag/cert-manager-admin-api/operation/getActive TAK Server Docs}.
+     */
+    listActive(): Promise<Static<typeof TAKList_Certificate>>;
     /**
      * List Revoked Certificates
      *
@@ -84,6 +126,33 @@ export default class CertificateCommands extends Commands {
      * {@link https://docs.tak.gov/api/takserver/redoc#tag/cert-manager-admin-api/operation/getExpired TAK Server Docs}.
      */
     listExpired(): Promise<Static<typeof TAKList_Certificate>>;
+    /**
+     * Probe whether the TAK Server accepts the credentials this API instance was created with
+     *
+     * The X509 filter runs on every request and rethrows on failure, so `GET /Marti/api/version`
+     * (an anonymous, DB-free endpoint returning a short string) is the cheapest authoritative
+     * check - unlike {@link validate} it reflects the server's actual enforcement (e.g. whether
+     * `x509checkRevocation` is enabled) and requires no admin credentials. An expired client
+     * certificate is rejected during the TLS handshake and surfaces as `reason: 'tls'`.
+     *
+     * Only authentication failures are returned as a verdict - any other error (server
+     * unreachable, unexpected status) is rethrown so it is not mistaken for a rejection
+     */
+    probe(): Promise<Static<typeof CertificateProbe>>;
+    /**
+     * Validate a PEM encoded client certificate against local expiry and the TAK Server revocation record
+     *
+     * Expiry is evaluated locally from the certificate. Revocation is looked up via the
+     * Certificate Admin API using the same SHA-256 fingerprint the TAK Server `X509Authenticator`
+     * consults - `get(hash)` first (a single cached row) falling back to the user's certificate
+     * list when the TAK Server answers 500, which is how it reports an unknown hash.
+     *
+     * Note: The TAK Server only enforces revocation when `auth.x509checkRevocation` (or
+     * `x509TokenAuth`) is enabled in CoreConfig - `revoked` reports the stored state regardless
+     */
+    validate(pem: string, opts?: {
+        now?: Date;
+    }): Promise<Static<typeof CertificateValidation>>;
     /**
      * Get Single Certificate
      *
@@ -96,6 +165,14 @@ export default class CertificateCommands extends Commands {
      * {@link https://docs.tak.gov/api/takserver/redoc#tag/cert-manager-admin-api/operation/downloadCertificate TAK Server Docs}.
      */
     download(hash: string): Promise<string>;
+    /**
+     * Download Certificates by Id
+     *
+     * Returns a ZIP archive stream containing one `{n}_{userDn}_ClientCert.pem` entry per certificate
+     *
+     * {@link https://docs.tak.gov/api/takserver/redoc#tag/cert-manager-admin-api/operation/downloadCertificates TAK Server Docs}.
+     */
+    downloadIds(ids: Array<string | number>): Promise<Readable>;
     /**
      * Revoke Single Certificate
      *

package/dist/lib/api/certificate.js

@@ -1,4 +1,7 @@
 import Commands from '../commands.js';
+import Err from '@openaddresses/batch-error';
+import { X509Certificate } from 'node:crypto';
+import { TAKServerError } from '../utils/html-error.js';
 import { Type } from '@sinclair/typebox';
 import { TAKItem, TAKList } from './types.js';
 export const Certificate = Type.Object({
@@ -18,6 +21,41 @@ export const Certificate = Type.Object({
 });
 export const TAKList_Certificate = TAKList(Certificate);
 export const TAKItem_Certificate = TAKItem(Certificate);
+export const CertificateValidation = Type.Object({
+    fingerprint: Type.String({ description: 'SHA-256 fingerprint of the DER encoded certificate - the TAK Server `hash`' }),
+    subject: Type.String(),
+    username: Type.String({ description: 'Common Name of the certificate subject - the TAK Server `userDn`' }),
+    validFrom: Type.String(),
+    validTo: Type.String(),
+    expired: Type.Boolean({ description: 'validTo is in the past' }),
+    known: Type.Boolean({ description: 'The TAK Server has a record for this fingerprint' }),
+    revoked: Type.Boolean({ description: 'The TAK Server record carries a revocationDate' }),
+    revocationDate: Type.Optional(Type.String({ format: 'date-time' })),
+    valid: Type.Boolean({ description: 'Neither expired nor revoked' }),
+    certificate: Type.Optional(Certificate)
+});
+export const CertificateProbe = Type.Object({
+    accepted: Type.Boolean({ description: 'The TAK Server authenticated the credentials' }),
+    version: Type.Optional(Type.String({ description: 'TAK Server version string when accepted' })),
+    reason: Type.Optional(Type.Union([
+        Type.Literal('revoked', { description: 'X509Authenticator raised RevokedException' }),
+        Type.Literal('rejected', { description: 'Authentication failed for another reason (BadCredentialsException)' }),
+        Type.Literal('tls', { description: 'The TLS handshake failed - typically an expired or untrusted client certificate' })
+    ])),
+    message: Type.Optional(Type.String())
+});
+/**
+ * Extract the Common Name from an X509 subject string as reported by Node
+ * (newline separated `key=value` pairs)
+ */
+function commonName(subject) {
+    for (const line of subject.split('\n')) {
+        const [key, ...rest] = line.split('=');
+        if (key.trim() === 'CN')
+            return rest.join('=').trim();
+    }
+    return undefined;
+}
 export default class CertificateCommands extends Commands {
     schema = {};
     async cli() {
@@ -35,6 +73,17 @@ export default class CertificateCommands extends Commands {
         }
         return await this.api.fetch(url);
     }
+    /**
+     * List Active Certificates
+     *
+     * The most recently issued certificate for each Client UID / User DN pair
+     *
+     * {@link https://docs.tak.gov/api/takserver/redoc#tag/cert-manager-admin-api/operation/getActive TAK Server Docs}.
+     */
+    async listActive() {
+        const url = new URL('/Marti/api/certadmin/cert/active', this.api.url);
+        return await this.api.fetch(url);
+    }
     /**
      * List Revoked Certificates
      *
@@ -62,6 +111,93 @@ export default class CertificateCommands extends Commands {
         const url = new URL('/Marti/api/certadmin/cert/expired', this.api.url);
         return await this.api.fetch(url);
     }
+    /**
+     * Probe whether the TAK Server accepts the credentials this API instance was created with
+     *
+     * The X509 filter runs on every request and rethrows on failure, so `GET /Marti/api/version`
+     * (an anonymous, DB-free endpoint returning a short string) is the cheapest authoritative
+     * check - unlike {@link validate} it reflects the server's actual enforcement (e.g. whether
+     * `x509checkRevocation` is enabled) and requires no admin credentials. An expired client
+     * certificate is rejected during the TLS handshake and surfaces as `reason: 'tls'`.
+     *
+     * Only authentication failures are returned as a verdict - any other error (server
+     * unreachable, unexpected status) is rethrown so it is not mistaken for a rejection
+     */
+    async probe() {
+        const url = new URL('/Marti/api/version', this.api.url);
+        try {
+            const version = String(await this.api.fetch(url)).trim();
+            return { accepted: true, version };
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            const details = err instanceof TAKServerError ? err.details : '';
+            const haystack = `${message}\n${details}`;
+            let reason;
+            if (/RevokedException|revoked certificate/i.test(haystack)) {
+                reason = 'revoked';
+            }
+            else if (/BadCredentialsException|AuthenticationException|TAK Server authentication/i.test(haystack)) {
+                reason = 'rejected';
+            }
+            else if (err instanceof Err && err.status === 400 && !(err instanceof TAKServerError)
+                && /certificate|handshake|alert|EPROTO|ECONNRESET|SSL|TLS/i.test(haystack)) {
+                reason = 'tls';
+            }
+            else {
+                throw err;
+            }
+            return { accepted: false, reason, message };
+        }
+    }
+    /**
+     * Validate a PEM encoded client certificate against local expiry and the TAK Server revocation record
+     *
+     * Expiry is evaluated locally from the certificate. Revocation is looked up via the
+     * Certificate Admin API using the same SHA-256 fingerprint the TAK Server `X509Authenticator`
+     * consults - `get(hash)` first (a single cached row) falling back to the user's certificate
+     * list when the TAK Server answers 500, which is how it reports an unknown hash.
+     *
+     * Note: The TAK Server only enforces revocation when `auth.x509checkRevocation` (or
+     * `x509TokenAuth`) is enabled in CoreConfig - `revoked` reports the stored state regardless
+     */
+    async validate(pem, opts = {}) {
+        const x509 = new X509Certificate(pem);
+        const now = opts.now ?? new Date();
+        const username = commonName(x509.subject);
+        if (!username)
+            throw new Error('Certificate subject does not contain a Common Name');
+        const fingerprint = x509.fingerprint256.toUpperCase();
+        let certificate;
+        try {
+            // Single cached row lookup - the same query X509Authenticator performs
+            certificate = (await this.get(fingerprint)).data;
+        }
+        catch (err) {
+            // The TAK Server reports an unknown hash via sendError(500), which is
+            // indistinguishable from a genuine failure - disambiguate against the
+            // (uncached, but authoritative) list of the user's certificates
+            if (!(err instanceof Err) || err.status < 500)
+                throw err;
+            certificate = (await this.list(username)).data
+                .find((cert) => cert.hash.toUpperCase() === fingerprint);
+        }
+        const expired = Date.parse(x509.validTo) < now.getTime();
+        const revoked = !!certificate?.revocationDate;
+        return {
+            fingerprint,
+            subject: x509.subject,
+            username,
+            validFrom: x509.validFrom,
+            validTo: x509.validTo,
+            expired,
+            known: !!certificate,
+            revoked,
+            revocationDate: certificate?.revocationDate,
+            valid: !expired && !revoked,
+            certificate
+        };
+    }
     /**
      * Get Single Certificate
      *
@@ -82,6 +218,29 @@ export default class CertificateCommands extends Commands {
             method: 'GET',
         });
     }
+    /**
+     * Download Certificates by Id
+     *
+     * Returns a ZIP archive stream containing one `{n}_{userDn}_ClientCert.pem` entry per certificate
+     *
+     * {@link https://docs.tak.gov/api/takserver/redoc#tag/cert-manager-admin-api/operation/downloadCertificates TAK Server Docs}.
+     */
+    async downloadIds(ids) {
+        if (ids.length === 0) {
+            throw new Error('At least one ID must be provided');
+        }
+        const url = new URL(`/Marti/api/certadmin/cert/download/${ids.map((id) => encodeURIComponent(String(id))).join(',')}`, this.api.url);
+        const res = await this.api.fetch(url, {
+            method: 'GET'
+        }, true);
+        // The raw fetch path skips status validation - without this check a
+        // TAK Server error page would be streamed as if it were the ZIP archive
+        if (res.status < 200 || res.status >= 400) {
+            const body = await res.text().catch(() => '');
+            throw new Err(res.status, null, body || `Status Code: ${res.status}`);
+        }
+        return res.body;
+    }
     /**
      * Revoke Single Certificate
      *

package/dist/lib/api/certificate.js.map

@@ -1 +1 @@
-{"version":3,"file":"certificate.js","sourceRoot":"","sources":["../../../lib/api/certificate.ts"],"names":[],"mappings":"AAAA,OAAO,QAAQ,MAAM,gBAAgB,CAAC;AACtC,OAAO,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAC;AAEzC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAE9C,MAAM,CAAC,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC;IACnC,EAAE,EAAE,IAAI,CAAC,OAAO,EAAE;IAClB,SAAS,EAAE,IAAI,CAAC,MAAM,EAAE;IACxB,SAAS,EAAE,IAAI,CAAC,MAAM,EAAE;IACxB,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE;IACrB,WAAW,EAAE,IAAI,CAAC,MAAM,EAAE;IAC1B,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE;IACnB,SAAS,EAAE,IAAI,CAAC,MAAM,EAAE;IACxB,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAClD,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IACpD,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IACnD,cAAc,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;IACnE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE;IACpB,YAAY,EAAE,IAAI,CAAC,MAAM,EAAE;CAC9B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;AACxD,MAAM,CAAC,MAAM,mBAAmB,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;AAExD,MAAM,CAAC,OAAO,OAAO,mBAAoB,SAAQ,QAAQ;IACrD,MAAM,GAAG,EAAE,CAAA;IAEX,KAAK,CAAC,GAAG;QACL,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC9C,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,IAAI,CACN,QAAiB;QAEjB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,2BAA2B,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAE/D,IAAI,QAAQ,EAAE,CAAC;YACX,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QAClD,CAAC;QAED,OAAO,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAuC,CAAC;IAC3E,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,WAAW;QACb,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,mCAAmC,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAEvE,OAAO,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAuC,CAAC;IAC3E,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,YAAY;QACd,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,oCAAoC,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAExE,OAAO,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAuC,CAAC;IAC3E,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,WAAW;QACb,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,mCAAmC,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAEvE,OAAO,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAuC,CAAC;IAC3E,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,GAAG,CACL,IAAY;QAEZ,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,6BAA6B,IAAI,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAEvE,OAAO,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAuC,CAAC;IAC3E,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,QAAQ,CACV,IAAY;QAEZ,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,6BAA6B,IAAI,WAAW,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAEhF,OAAO,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE;YAC7B,MAAM,EAAE,KAAK;SAChB,CAAW,CAAC;IACjB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,MAAM,CACR,IAAY;QAEZ,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,6BAA6B,IAAI,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAEvE,OAAO,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE;YAC7B,MAAM,EAAE,QAAQ;SACnB,CAAuC,CAAC;IAC7C,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,SAAS,CACX,GAAa;QAEb,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACxD,CAAC;aAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,yEAAyE;YACzE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACtE,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,oCAAoC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAEhF,OAAO,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE;YAC7B,MAAM,EAAE,QAAQ;SACnB,CAAuC,CAAC;IAC7C,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,SAAS,CACX,GAAa;QAEb,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACxD,CAAC;aAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,yEAAyE;YACzE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACtE,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,oCAAoC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAEhF,OAAO,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE;YAC7B,MAAM,EAAE,QAAQ;SACnB,CAAuC,CAAC;IAC7C,CAAC;CACJ"}
+{"version":3,"file":"certificate.js","sourceRoot":"","sources":["../../../lib/api/certificate.ts"],"names":[],"mappings":"AAAA,OAAO,QAAQ,MAAM,gBAAgB,CAAC;AACtC,OAAO,GAAG,MAAM,4BAA4B,CAAC;AAE7C,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAC;AAEzC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAE9C,MAAM,CAAC,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC;IACnC,EAAE,EAAE,IAAI,CAAC,OAAO,EAAE;IAClB,SAAS,EAAE,IAAI,CAAC,MAAM,EAAE;IACxB,SAAS,EAAE,IAAI,CAAC,MAAM,EAAE;IACxB,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE;IACrB,WAAW,EAAE,IAAI,CAAC,MAAM,EAAE;IAC1B,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE;IACnB,SAAS,EAAE,IAAI,CAAC,MAAM,EAAE;IACxB,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAClD,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IACpD,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IACnD,cAAc,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;IACnE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE;IACpB,YAAY,EAAE,IAAI,CAAC,MAAM,EAAE;CAC9B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;AACxD,MAAM,CAAC,MAAM,mBAAmB,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;AAExD,MAAM,CAAC,MAAM,qBAAqB,GAAG,IAAI,CAAC,MAAM,CAAC;IAC7C,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,4EAA4E,EAAE,CAAC;IACvH,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE;IACtB,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,kEAAkE,EAAE,CAAC;IAC1G,SAAS,EAAE,IAAI,CAAC,MAAM,EAAE;IACxB,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE;IACtB,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,WAAW,EAAE,wBAAwB,EAAE,CAAC;IAChE,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,WAAW,EAAE,kDAAkD,EAAE,CAAC;IACxF,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,WAAW,EAAE,gDAAgD,EAAE,CAAC;IACxF,cAAc,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;IACnE,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,WAAW,EAAE,6BAA6B,EAAE,CAAC;IACnE,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC;CAC1C,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,CAAC,MAAM,CAAC;IACxC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,WAAW,EAAE,8CAA8C,EAAE,CAAC;IACvF,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,yCAAyC,EAAE,CAAC,CAAC;IAC/F,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC;QAC7B,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,WAAW,EAAE,2CAA2C,EAAE,CAAC;QACrF,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,WAAW,EAAE,oEAAoE,EAAE,CAAC;QAC/G,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,WAAW,EAAE,iFAAiF,EAAE,CAAC;KAC1H,CAAC,CAAC;IACH,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;CACxC,CAAC,CAAC;AAEH;;;GAGG;AACH,SAAS,UAAU,CAAC,OAAe;IAC/B,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1D,CAAC;IAED,OAAO,SAAS,CAAC;AACrB,CAAC;AAED,MAAM,CAAC,OAAO,OAAO,mBAAoB,SAAQ,QAAQ;IACrD,MAAM,GAAG,EAAE,CAAA;IAEX,KAAK,CAAC,GAAG;QACL,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC9C,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,IAAI,CACN,QAAiB;QAEjB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,2BAA2B,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAE/D,IAAI,QAAQ,EAAE,CAAC;YACX,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QAClD,CAAC;QAED,OAAO,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAuC,CAAC;IAC3E,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,UAAU;QACZ,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,kCAAkC,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAEtE,OAAO,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAuC,CAAC;IAC3E,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,WAAW;QACb,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,mCAAmC,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAEvE,OAAO,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAuC,CAAC;IAC3E,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,YAAY;QACd,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,oCAAoC,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAExE,OAAO,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAuC,CAAC;IAC3E,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,WAAW;QACb,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,mCAAmC,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAEvE,OAAO,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAuC,CAAC;IAC3E,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,KAAK;QACP,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,oBAAoB,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAExD,IAAI,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAEzD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QACvC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,MAAM,OAAO,GAAG,GAAG,YAAY,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;YACjE,MAAM,QAAQ,GAAG,GAAG,OAAO,KAAK,OAAO,EAAE,CAAC;YAE1C,IAAI,MAAiD,CAAC;YACtD,IAAI,uCAAuC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACzD,MAAM,GAAG,SAAS,CAAC;YACvB,CAAC;iBAAM,IAAI,4EAA4E,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACrG,MAAM,GAAG,UAAU,CAAC;YACxB,CAAC;iBAAM,IACH,GAAG,YAAY,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,GAAG,YAAY,cAAc,CAAC;mBACzE,wDAAwD,CAAC,IAAI,CAAC,QAAQ,CAAC,EAC5E,CAAC;gBACC,MAAM,GAAG,KAAK,CAAC;YACnB,CAAC;iBAAM,CAAC;gBACJ,MAAM,GAAG,CAAC;YACd,CAAC;YAED,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;QAChD,CAAC;IACL,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,QAAQ,CACV,GAAW,EACX,OAEI,EAAE;QAEN,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC,GAAG,CAAC,CAAC;QACtC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;QAEnC,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC1C,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QAErF,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,CAAC,WAAW,EAAE,CAAC;QAEtD,IAAI,WAAmD,CAAC;QACxD,IAAI,CAAC;YACD,uEAAuE;YACvE,WAAW,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;QACrD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,sEAAsE;YACtE,sEAAsE;YACtE,gEAAgE;YAChE,IAAI,CAAC,CAAC,GAAG,YAAY,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG;gBAAE,MAAM,GAAG,CAAC;YAEzD,WAAW,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI;iBACzC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,WAAW,CAAC,CAAC;QACjE,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;QACzD,MAAM,OAAO,GAAG,CAAC,CAAC,WAAW,EAAE,cAAc,CAAC;QAE9C,OAAO;YACH,WAAW;YACX,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,QAAQ;YACR,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,OAAO;YACP,KAAK,EAAE,CAAC,CAAC,WAAW;YACpB,OAAO;YACP,cAAc,EAAE,WAAW,EAAE,cAAc;YAC3C,KAAK,EAAE,CAAC,OAAO,IAAI,CAAC,OAAO;YAC3B,WAAW;SACd,CAAC;IACN,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,GAAG,CACL,IAAY;QAEZ,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,6BAA6B,IAAI,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAEvE,OAAO,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAuC,CAAC;IAC3E,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,QAAQ,CACV,IAAY;QAEZ,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,6BAA6B,IAAI,WAAW,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAEhF,OAAO,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE;YAC7B,MAAM,EAAE,KAAK;SAChB,CAAW,CAAC;IACjB,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,WAAW,CACb,GAA2B;QAE3B,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACxD,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,sCAAsC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAErI,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE;YAClC,MAAM,EAAE,KAAK;SAChB,EAAE,IAAI,CAAC,CAAC;QAET,oEAAoE;QACpE,wEAAwE;QACxE,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;YACxC,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YAC9C,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,IAAI,gBAAgB,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QAC1E,CAAC;QAED,OAAO,GAAG,CAAC,IAAI,CAAC;IACpB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,MAAM,CACR,IAAY;QAEZ,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,6BAA6B,IAAI,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAEvE,OAAO,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE;YAC7B,MAAM,EAAE,QAAQ;SACnB,CAAuC,CAAC;IAC7C,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,SAAS,CACX,GAAa;QAEb,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACxD,CAAC;aAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,yEAAyE;YACzE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACtE,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,oCAAoC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAEhF,OAAO,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE;YAC7B,MAAM,EAAE,QAAQ;SACnB,CAAuC,CAAC;IAC7C,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,SAAS,CACX,GAAa;QAEb,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACxD,CAAC;aAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,yEAAyE;YACzE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACtE,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,oCAAoC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAEhF,OAAO,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE;YAC7B,MAAM,EAAE,QAAQ;SACnB,CAAuC,CAAC;IAC7C,CAAC;CACJ"}

package/dist/test/certificate.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/test/certificate.test.js

@@ -0,0 +1,301 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { Readable } from 'node:stream';
+import { Client } from 'undici';
+import TAKAPI from '../lib/api.js';
+import { APIAuthCertificate } from '../lib/auth.js';
+function mockResponse(statusCode, contentType, body) {
+    return {
+        statusCode,
+        headers: { 'content-type': contentType },
+        body: Readable.from([Buffer.from(body)]),
+        trailers: {}
+    };
+}
+// Self-signed test certificate: O=CO-TAK, OU=WILDFIRE, CN=alice@example.com, expires 2036-08-22
+const FIXTURE_PEM = `-----BEGIN CERTIFICATE-----
+MIIB1TCCAXugAwIBAgIUHPumta9q/l2whKqG1nGD9pJ/uogwCgYIKoZIzj0EAwIw
+QDEPMA0GA1UECgwGQ08tVEFLMREwDwYDVQQLDAhXSUxERklSRTEaMBgGA1UEAwwR
+YWxpY2VAZXhhbXBsZS5jb20wHhcNMjYwODI1MDEwNTQxWhcNMzYwODIyMDEwNTQx
+WjBAMQ8wDQYDVQQKDAZDTy1UQUsxETAPBgNVBAsMCFdJTERGSVJFMRowGAYDVQQD
+DBFhbGljZUBleGFtcGxlLmNvbTBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABB45
+OnCT2nVQVxlgKDLttbhLW9Yjs2/elFjAZkil+iI0QLM+vtRjdoCdI+NhADggvJ65
++++JRYr8Kv2zwv2joSKjUzBRMB0GA1UdDgQWBBS8Depzqkj88/9GNHWY8GmyreFB
+VTAfBgNVHSMEGDAWgBS8Depzqkj88/9GNHWY8GmyreFBVTAPBgNVHRMBAf8EBTAD
+AQH/MAoGCCqGSM49BAMCA0gAMEUCIQCU1mg7e/Eu4A84SemDc0bIQHTnM9aVP8h1
+LaburcgKWwIgYeKSRCQGrM1cEhJQbqJC6UWpJUGxGcclcMzGjqx7WpQ=
+-----END CERTIFICATE-----`;
+const FIXTURE_FINGERPRINT = '37:CA:5A:CD:2E:AC:F5:41:09:4B:DE:21:34:9F:A8:83:C4:43:20:71:7E:7F:CC:EC:97:2C:9E:AE:E9:5F:83:40';
+const GET_PATH = `/Marti/api/certadmin/cert/${FIXTURE_FINGERPRINT}`;
+const LIST_PATH = '/Marti/api/certadmin/cert?username=alice%40example.com';
+function certList(certs) {
+    return JSON.stringify({ version: '3', type: 'TakCert', data: certs, nodeId: 'node' });
+}
+function certItem(cert) {
+    return JSON.stringify({ version: '3', type: 'TakCert', data: cert, nodeId: 'node' });
+}
+// Tomcat's default page for response.sendError(500) - what the TAK Server
+// returns from getCertificate() when the hash is unknown
+const TOMCAT_500 = '<!doctype html><html lang="en"><head><title>HTTP Status 500 – Internal Server Error</title></head><body><h1>HTTP Status 500 – Internal Server Error</h1></body></html>';
+async function collect(stream) {
+    const chunks = [];
+    for await (const chunk of stream)
+        chunks.push(Buffer.from(chunk));
+    return Buffer.concat(chunks);
+}
+/**
+ * Install a path-keyed mock; returns the list of paths requested in order
+ */
+function mockRoutes(routes) {
+    const originalRequest = Client.prototype.request;
+    const paths = [];
+    Client.prototype.request = async function (opts) {
+        const path = String(opts.path);
+        paths.push(path);
+        const route = routes[path];
+        if (!route)
+            throw new Error(`Unexpected request: ${opts.method ?? 'GET'} ${path}`);
+        return route();
+    };
+    return { paths, restore: () => { Client.prototype.request = originalRequest; } };
+}
+function api() {
+    return new TAKAPI(new URL('https://tak.example.com'), new APIAuthCertificate('cert', 'key'));
+}
+test('Certificate.listActive requests the active certificate list', async () => {
+    const mock = mockRoutes({
+        '/Marti/api/certadmin/cert/active': () => mockResponse(200, 'application/json', certList([{ id: 1, hash: 'abc', userDn: 'alice' }]))
+    });
+    try {
+        const res = await api().Certificate.listActive();
+        assert.deepEqual(mock.paths, ['/Marti/api/certadmin/cert/active']);
+        assert.equal(res.data.length, 1);
+        assert.equal(res.data[0].hash, 'abc');
+    }
+    finally {
+        mock.restore();
+    }
+});
+test('Certificate.validate resolves a known certificate with a single get(hash) call', async () => {
+    const mock = mockRoutes({
+        [GET_PATH]: () => mockResponse(200, 'application/json', certItem({ id: 2, hash: FIXTURE_FINGERPRINT, userDn: 'alice@example.com' }))
+    });
+    try {
+        const res = await api().Certificate.validate(FIXTURE_PEM);
+        assert.deepEqual(mock.paths, [GET_PATH]);
+        assert.equal(res.fingerprint, FIXTURE_FINGERPRINT);
+        assert.equal(res.username, 'alice@example.com');
+        assert.equal(res.expired, false);
+        assert.equal(res.known, true);
+        assert.equal(res.revoked, false);
+        assert.equal(res.revocationDate, undefined);
+        assert.equal(res.valid, true);
+        assert.equal(res.certificate?.id, 2);
+    }
+    finally {
+        mock.restore();
+    }
+});
+test('Certificate.validate reports a revoked certificate', async () => {
+    const mock = mockRoutes({
+        [GET_PATH]: () => mockResponse(200, 'application/json', certItem({ id: 2, hash: FIXTURE_FINGERPRINT, userDn: 'alice@example.com', revocationDate: '2026-08-24T21:00:00.000Z' }))
+    });
+    try {
+        const res = await api().Certificate.validate(FIXTURE_PEM);
+        assert.equal(res.known, true);
+        assert.equal(res.revoked, true);
+        assert.equal(res.revocationDate, '2026-08-24T21:00:00.000Z');
+        assert.equal(res.expired, false);
+        assert.equal(res.valid, false);
+    }
+    finally {
+        mock.restore();
+    }
+});
+test('Certificate.validate falls back to the user list when get(hash) answers 500 and matches case-insensitively', async () => {
+    const mock = mockRoutes({
+        [GET_PATH]: () => mockResponse(500, 'text/html', TOMCAT_500),
+        [LIST_PATH]: () => mockResponse(200, 'application/json', certList([
+            { id: 1, hash: 'AA:BB', userDn: 'alice@example.com', revocationDate: '2026-01-01T00:00:00.000Z' },
+            { id: 2, hash: FIXTURE_FINGERPRINT.toLowerCase(), userDn: 'alice@example.com' }
+        ]))
+    });
+    try {
+        const res = await api().Certificate.validate(FIXTURE_PEM);
+        assert.deepEqual(mock.paths, [GET_PATH, LIST_PATH]);
+        assert.equal(res.known, true);
+        assert.equal(res.revoked, false);
+        assert.equal(res.valid, true);
+        assert.equal(res.certificate?.id, 2);
+    }
+    finally {
+        mock.restore();
+    }
+});
+test('Certificate.validate reports an unknown certificate as not revoked but not known', async () => {
+    const mock = mockRoutes({
+        [GET_PATH]: () => mockResponse(500, 'text/html', TOMCAT_500),
+        [LIST_PATH]: () => mockResponse(200, 'application/json', certList([]))
+    });
+    try {
+        const res = await api().Certificate.validate(FIXTURE_PEM);
+        assert.deepEqual(mock.paths, [GET_PATH, LIST_PATH]);
+        assert.equal(res.known, false);
+        assert.equal(res.revoked, false);
+        assert.equal(res.certificate, undefined);
+        assert.equal(res.valid, true);
+    }
+    finally {
+        mock.restore();
+    }
+});
+test('Certificate.validate rethrows non-500 failures from get(hash) without consulting the list', async () => {
+    const mock = mockRoutes({
+        [GET_PATH]: () => mockResponse(403, 'text/plain', 'Forbidden')
+    });
+    try {
+        await assert.rejects(() => api().Certificate.validate(FIXTURE_PEM), (err) => {
+            assert.equal(err.status, 403);
+            return true;
+        });
+        assert.deepEqual(mock.paths, [GET_PATH]);
+    }
+    finally {
+        mock.restore();
+    }
+});
+test('Certificate.validate evaluates expiry locally against the supplied clock', async () => {
+    const mock = mockRoutes({
+        [GET_PATH]: () => mockResponse(200, 'application/json', certItem({ id: 2, hash: FIXTURE_FINGERPRINT, userDn: 'alice@example.com' }))
+    });
+    try {
+        const res = await api().Certificate.validate(FIXTURE_PEM, { now: new Date('2040-01-01T00:00:00Z') });
+        assert.equal(res.expired, true);
+        assert.equal(res.revoked, false);
+        assert.equal(res.valid, false);
+    }
+    finally {
+        mock.restore();
+    }
+});
+test('Certificate.validate rejects a PEM that is not a certificate', async () => {
+    await assert.rejects(() => api().Certificate.validate('not a certificate'));
+});
+test('Certificate.probe reports accepted credentials with the server version', async () => {
+    const mock = mockRoutes({
+        '/Marti/api/version': () => mockResponse(200, 'text/plain', 'TAK Server 5.4-RELEASE-1\n')
+    });
+    try {
+        const res = await api().Certificate.probe();
+        assert.deepEqual(mock.paths, ['/Marti/api/version']);
+        assert.deepEqual(res, { accepted: true, version: 'TAK Server 5.4-RELEASE-1' });
+    }
+    finally {
+        mock.restore();
+    }
+});
+test('Certificate.probe classifies a RevokedException error page as revoked', async () => {
+    const mock = mockRoutes({
+        '/Marti/api/version': () => mockResponse(500, 'text/html', [
+            '<!doctype html><html lang="en"><head><title>HTTP Status 500 – Internal Server Error</title></head><body>',
+            '<h1>HTTP Status 500 – Internal Server Error</h1><p><b>Type</b> Exception Report</p>',
+            '<p><b>Message</b> Exception performing TAK Server authentication</p>',
+            '<p><b>Exception</b></p><pre>org.springframework.security.authentication.BadCredentialsException: Exception performing TAK Server authentication</pre>',
+            '<p><b>Root Cause</b></p><pre>com.bbn.marti.remote.exception.RevokedException: Attempt to use revoked certificate : CN=alice@example.com,OU=WILDFIRE,O=CO-TAK</pre>',
+            '</body></html>'
+        ].join(''))
+    });
+    try {
+        const res = await api().Certificate.probe();
+        assert.equal(res.accepted, false);
+        assert.equal(res.reason, 'revoked');
+        assert.ok(res.message);
+    }
+    finally {
+        mock.restore();
+    }
+});
+test('Certificate.probe classifies a BadCredentialsException without a revocation cause as rejected', async () => {
+    const mock = mockRoutes({
+        '/Marti/api/version': () => mockResponse(500, 'text/plain', 'org.springframework.security.authentication.BadCredentialsException: Exception performing TAK Server authentication')
+    });
+    try {
+        const res = await api().Certificate.probe();
+        assert.equal(res.accepted, false);
+        assert.equal(res.reason, 'rejected');
+    }
+    finally {
+        mock.restore();
+    }
+});
+test('Certificate.probe classifies a TLS handshake failure as tls', async () => {
+    const originalRequest = Client.prototype.request;
+    Client.prototype.request = async function () {
+        const err = new Error('fetch failed');
+        err.cause = Object.assign(new Error('write EPROTO SSL routines:ssl3_read_bytes:sslv3 alert bad certificate'), { code: 'EPROTO' });
+        throw err;
+    };
+    try {
+        const res = await api().Certificate.probe();
+        assert.equal(res.accepted, false);
+        assert.equal(res.reason, 'tls');
+        assert.match(res.message ?? '', /EPROTO/);
+    }
+    finally {
+        Client.prototype.request = originalRequest;
+    }
+});
+test('Certificate.probe rethrows errors that are not authentication failures', async () => {
+    const mock = mockRoutes({
+        '/Marti/api/version': () => mockResponse(503, 'text/plain', 'Service Unavailable')
+    });
+    try {
+        await assert.rejects(() => api().Certificate.probe(), (err) => {
+            assert.equal(err.status, 503);
+            return true;
+        });
+    }
+    finally {
+        mock.restore();
+    }
+});
+test('Certificate.downloadIds streams the ZIP archive for the given IDs', async () => {
+    const mock = mockRoutes({
+        '/Marti/api/certadmin/cert/download/1,2,3': () => mockResponse(200, 'application/zip', Buffer.from('zip-bytes'))
+    });
+    try {
+        const body = await collect(await api().Certificate.downloadIds([1, '2', 3]));
+        assert.deepEqual(mock.paths, ['/Marti/api/certadmin/cert/download/1,2,3']);
+        assert.equal(body.toString(), 'zip-bytes');
+    }
+    finally {
+        mock.restore();
+    }
+});
+test('Certificate.downloadIds rejects an empty ID list without a request', async () => {
+    const mock = mockRoutes({});
+    try {
+        await assert.rejects(() => api().Certificate.downloadIds([]), /At least one ID must be provided/);
+        assert.deepEqual(mock.paths, []);
+    }
+    finally {
+        mock.restore();
+    }
+});
+test('Certificate.downloadIds throws on a TAK Server error instead of streaming the error page', async () => {
+    const mock = mockRoutes({
+        '/Marti/api/certadmin/cert/download/1': () => mockResponse(500, 'text/plain', 'exception in downloadCertificates!')
+    });
+    try {
+        await assert.rejects(() => api().Certificate.downloadIds([1]), (err) => {
+            assert.ok(err instanceof Error);
+            assert.equal(err.status, 500);
+            assert.match(err.message, /downloadCertificates/);
+            return true;
+        });
+    }
+    finally {
+        mock.restore();
+    }
+});
+//# sourceMappingURL=certificate.test.js.map

package/dist/test/certificate.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"certificate.test.js","sourceRoot":"","sources":["../../test/certificate.test.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEhC,OAAO,MAAM,MAAM,eAAe,CAAC;AACnC,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAIpD,SAAS,YAAY,CAAC,UAAkB,EAAE,WAAmB,EAAE,IAAqB;IAChF,OAAO;QACH,UAAU;QACV,OAAO,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE;QACxC,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACxC,QAAQ,EAAE,EAAE;KACuB,CAAC;AAC5C,CAAC;AAED,gGAAgG;AAChG,MAAM,WAAW,GAAG;;;;;;;;;;;0BAWM,CAAC;AAC3B,MAAM,mBAAmB,GAAG,iGAAiG,CAAC;AAC9H,MAAM,QAAQ,GAAG,6BAA6B,mBAAmB,EAAE,CAAC;AACpE,MAAM,SAAS,GAAG,wDAAwD,CAAC;AAE3E,SAAS,QAAQ,CAAC,KAAe;IAC7B,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;AAC1F,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY;IAC1B,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;AACzF,CAAC;AAED,0EAA0E;AAC1E,yDAAyD;AACzD,MAAM,UAAU,GAAG,wKAAwK,CAAC;AAE5L,KAAK,UAAU,OAAO,CAAC,MAAgB;IACnC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,MAAM;QAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAClE,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AACjC,CAAC;AAED;;GAEG;AACH,SAAS,UAAU,CAAC,MAAqD;IACrE,MAAM,eAAe,GAAG,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC;IACjD,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,MAAM,CAAC,SAAS,CAAC,OAAO,GAAG,KAAK,WAAU,IAAiB;QACvD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QAC3B,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,IAAI,CAAC,MAAM,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC,CAAC;QACnF,OAAO,KAAK,EAAE,CAAC;IACnB,CAAC,CAAC;IAEF,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,CAAC,OAAO,GAAG,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC;AACrF,CAAC;AAED,SAAS,GAAG;IACR,OAAO,IAAI,MAAM,CAAC,IAAI,GAAG,CAAC,yBAAyB,CAAC,EAAE,IAAI,kBAAkB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;AACjG,CAAC;AAED,IAAI,CAAC,6DAA6D,EAAE,KAAK,IAAI,EAAE;IAC3E,MAAM,IAAI,GAAG,UAAU,CAAC;QACpB,kCAAkC,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,kBAAkB,EAAE,QAAQ,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;KACvI,CAAC,CAAC;IAEH,IAAI,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,GAAG,EAAE,CAAC,WAAW,CAAC,UAAU,EAAE,CAAC;QAEjD,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,kCAAkC,CAAC,CAAC,CAAC;QACnE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QACjC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC1C,CAAC;YAAS,CAAC;QACP,IAAI,CAAC,OAAO,EAAE,CAAC;IACnB,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,gFAAgF,EAAE,KAAK,IAAI,EAAE;IAC9F,MAAM,IAAI,GAAG,UAAU,CAAC;QACpB,CAAC,QAAQ,CAAC,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,kBAAkB,EAAE,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC,CAAC;KACvI,CAAC,CAAC;IAEH,IAAI,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,GAAG,EAAE,CAAC,WAAW,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAE1D,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QACzC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE,mBAAmB,CAAC,CAAC;QACnD,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,mBAAmB,CAAC,CAAC;QAChD,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACjC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAC9B,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACjC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC;QAC5C,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAC9B,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IACzC,CAAC;YAAS,CAAC;QACP,IAAI,CAAC,OAAO,EAAE,CAAC;IACnB,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;IAClE,MAAM,IAAI,GAAG,UAAU,CAAC;QACpB,CAAC,QAAQ,CAAC,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,kBAAkB,EAAE,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,MAAM,EAAE,mBAAmB,EAAE,cAAc,EAAE,0BAA0B,EAAE,CAAC,CAAC;KACnL,CAAC,CAAC;IAEH,IAAI,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,GAAG,EAAE,CAAC,WAAW,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAE1D,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAC9B,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAChC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,EAAE,0BAA0B,CAAC,CAAC;QAC7D,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACjC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACnC,CAAC;YAAS,CAAC;QACP,IAAI,CAAC,OAAO,EAAE,CAAC;IACnB,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,4GAA4G,EAAE,KAAK,IAAI,EAAE;IAC1H,MAAM,IAAI,GAAG,UAAU,CAAC;QACpB,CAAC,QAAQ,CAAC,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,WAAW,EAAE,UAAU,CAAC;QAC5D,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,kBAAkB,EAAE,QAAQ,CAAC;YAC9D,EAAE,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,cAAc,EAAE,0BAA0B,EAAE;YACjG,EAAE,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,mBAAmB,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,mBAAmB,EAAE;SAClF,CAAC,CAAC;KACN,CAAC,CAAC;IAEH,IAAI,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,GAAG,EAAE,CAAC,WAAW,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAE1D,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;QACpD,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAC9B,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACjC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAC9B,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IACzC,CAAC;YAAS,CAAC;QACP,IAAI,CAAC,OAAO,EAAE,CAAC;IACnB,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,kFAAkF,EAAE,KAAK,IAAI,EAAE;IAChG,MAAM,IAAI,GAAG,UAAU,CAAC;QACpB,CAAC,QAAQ,CAAC,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,WAAW,EAAE,UAAU,CAAC;QAC5D,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,kBAAkB,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;KACzE,CAAC,CAAC;IAEH,IAAI,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,GAAG,EAAE,CAAC,WAAW,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAE1D,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;QACpD,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC/B,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACjC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QACzC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAClC,CAAC;YAAS,CAAC;QACP,IAAI,CAAC,OAAO,EAAE,CAAC;IACnB,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,2FAA2F,EAAE,KAAK,IAAI,EAAE;IACzG,MAAM,IAAI,GAAG,UAAU,CAAC;QACpB,CAAC,QAAQ,CAAC,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,YAAY,EAAE,WAAW,CAAC;KACjE,CAAC,CAAC;IAEH,IAAI,CAAC;QACD,MAAM,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,GAAY,EAAE,EAAE;YACjF,MAAM,CAAC,KAAK,CAAE,GAA2B,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;YACvD,OAAO,IAAI,CAAC;QAChB,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC7C,CAAC;YAAS,CAAC;QACP,IAAI,CAAC,OAAO,EAAE,CAAC;IACnB,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,0EAA0E,EAAE,KAAK,IAAI,EAAE;IACxF,MAAM,IAAI,GAAG,UAAU,CAAC;QACpB,CAAC,QAAQ,CAAC,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,kBAAkB,EAAE,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC,CAAC;KACvI,CAAC,CAAC;IAEH,IAAI,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,GAAG,EAAE,CAAC,WAAW,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,GAAG,EAAE,IAAI,IAAI,CAAC,sBAAsB,CAAC,EAAE,CAAC,CAAC;QAErG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAChC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACjC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACnC,CAAC;YAAS,CAAC;QACP,IAAI,CAAC,OAAO,EAAE,CAAC;IACnB,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,8DAA8D,EAAE,KAAK,IAAI,EAAE;IAC5E,MAAM,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC,CAAC;AAChF,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,wEAAwE,EAAE,KAAK,IAAI,EAAE;IACtF,MAAM,IAAI,GAAG,UAAU,CAAC;QACpB,oBAAoB,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,YAAY,EAAE,4BAA4B,CAAC;KAC5F,CAAC,CAAC;IAEH,IAAI,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,GAAG,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;QAE5C,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,oBAAoB,CAAC,CAAC,CAAC;QACrD,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC,CAAC;IACnF,CAAC;YAAS,CAAC;QACP,IAAI,CAAC,OAAO,EAAE,CAAC;IACnB,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,uEAAuE,EAAE,KAAK,IAAI,EAAE;IACrF,MAAM,IAAI,GAAG,UAAU,CAAC;QACpB,oBAAoB,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,WAAW,EAAE;YACvD,0GAA0G;YAC1G,qFAAqF;YACrF,sEAAsE;YACtE,uJAAuJ;YACvJ,oKAAoK;YACpK,gBAAgB;SACnB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;KACd,CAAC,CAAC;IAEH,IAAI,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,GAAG,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;QAE5C,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAClC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QACpC,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC3B,CAAC;YAAS,CAAC;QACP,IAAI,CAAC,OAAO,EAAE,CAAC;IACnB,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,+FAA+F,EAAE,KAAK,IAAI,EAAE;IAC7G,MAAM,IAAI,GAAG,UAAU,CAAC;QACpB,oBAAoB,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,YAAY,EAAE,qHAAqH,CAAC;KACrL,CAAC,CAAC;IAEH,IAAI,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,GAAG,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;QAE5C,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAClC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACzC,CAAC;YAAS,CAAC;QACP,IAAI,CAAC,OAAO,EAAE,CAAC;IACnB,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,6DAA6D,EAAE,KAAK,IAAI,EAAE;IAC3E,MAAM,eAAe,GAAG,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC;IAEjD,MAAM,CAAC,SAAS,CAAC,OAAO,GAAG,KAAK;QAC5B,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,cAAc,CAA8B,CAAC;QACnE,GAAG,CAAC,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,uEAAuE,CAAC,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;QAClI,MAAM,GAAG,CAAC;IACd,CAAC,CAAC;IAEF,IAAI,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,GAAG,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;QAE5C,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAClC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAChC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC9C,CAAC;YAAS,CAAC;QACP,MAAM,CAAC,SAAS,CAAC,OAAO,GAAG,eAAe,CAAC;IAC/C,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,wEAAwE,EAAE,KAAK,IAAI,EAAE;IACtF,MAAM,IAAI,GAAG,UAAU,CAAC;QACpB,oBAAoB,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,YAAY,EAAE,qBAAqB,CAAC;KACrF,CAAC,CAAC;IAEH,IAAI,CAAC;QACD,MAAM,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,CAAC,GAAY,EAAE,EAAE;YACnE,MAAM,CAAC,KAAK,CAAE,GAA2B,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;YACvD,OAAO,IAAI,CAAC;QAChB,CAAC,CAAC,CAAC;IACP,CAAC;YAAS,CAAC;QACP,IAAI,CAAC,OAAO,EAAE,CAAC;IACnB,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,mEAAmE,EAAE,KAAK,IAAI,EAAE;IACjF,MAAM,IAAI,GAAG,UAAU,CAAC;QACpB,0CAA0C,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,iBAAiB,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;KACnH,CAAC,CAAC;IAEH,IAAI,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,MAAM,GAAG,EAAE,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAE7E,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,0CAA0C,CAAC,CAAC,CAAC;QAC3E,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,WAAW,CAAC,CAAC;IAC/C,CAAC;YAAS,CAAC;QACP,IAAI,CAAC,OAAO,EAAE,CAAC;IACnB,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,oEAAoE,EAAE,KAAK,IAAI,EAAE;IAClF,MAAM,IAAI,GAAG,UAAU,CAAC,EAAE,CAAC,CAAC;IAE5B,IAAI,CAAC;QACD,MAAM,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,WAAW,CAAC,EAAE,CAAC,EAAE,kCAAkC,CAAC,CAAC;QAClG,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACrC,CAAC;YAAS,CAAC;QACP,IAAI,CAAC,OAAO,EAAE,CAAC;IACnB,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,0FAA0F,EAAE,KAAK,IAAI,EAAE;IACxG,MAAM,IAAI,GAAG,UAAU,CAAC;QACpB,sCAAsC,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,YAAY,EAAE,oCAAoC,CAAC;KACtH,CAAC,CAAC;IAEH,IAAI,CAAC;QACD,MAAM,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,GAAY,EAAE,EAAE;YAC5E,MAAM,CAAC,EAAE,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC;YAChC,MAAM,CAAC,KAAK,CAAE,GAA2B,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;YACvD,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,sBAAsB,CAAC,CAAC;YAClD,OAAO,IAAI,CAAC;QAChB,CAAC,CAAC,CAAC;IACP,CAAC;YAAS,CAAC;QACP,IAAI,CAAC,OAAO,EAAE,CAAC;IACnB,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/tsconfig.tsbuildinfo

@@ -1 +1 @@
-{"root":["../cli.ts","../index.ts","../test/default.test.ts","../test/findCoT.test.ts","../test/html-error.test.ts","../test/mission-layer.test.ts","../test/mission.test.ts","../test/pipeline.test.ts","../test/queue.test.ts","../test/uploadPackage.test.ts","../lib/api.ts","../lib/auth.ts","../lib/commands.ts","../lib/fetch.ts","../lib/multipart.ts","../lib/stream.ts","../lib/api/certificate.ts","../lib/api/client.ts","../lib/api/contacts.ts","../lib/api/credentials.ts","../lib/api/export.ts","../lib/api/files.ts","../lib/api/groups.ts","../lib/api/iconsets.ts","../lib/api/injectors.ts","../lib/api/locate.ts","../lib/api/mission-invite.ts","../lib/api/mission-layer.ts","../lib/api/mission-log.ts","../lib/api/mission.ts","../lib/api/oauth.ts","../lib/api/package.ts","../lib/api/profile.ts","../lib/api/query.ts","../lib/api/repeater.ts","../lib/api/security.ts","../lib/api/subscriptions.ts","../lib/api/types.ts","../lib/api/video.ts","../lib/utils/html-error.ts","../lib/utils/queue.ts"],"version":"6.0.3"}
+{"root":["../cli.ts","../index.ts","../test/certificate.test.ts","../test/default.test.ts","../test/findCoT.test.ts","../test/html-error.test.ts","../test/mission-layer.test.ts","../test/mission.test.ts","../test/pipeline.test.ts","../test/queue.test.ts","../test/uploadPackage.test.ts","../lib/api.ts","../lib/auth.ts","../lib/commands.ts","../lib/fetch.ts","../lib/multipart.ts","../lib/stream.ts","../lib/api/certificate.ts","../lib/api/client.ts","../lib/api/contacts.ts","../lib/api/credentials.ts","../lib/api/export.ts","../lib/api/files.ts","../lib/api/groups.ts","../lib/api/iconsets.ts","../lib/api/injectors.ts","../lib/api/locate.ts","../lib/api/mission-invite.ts","../lib/api/mission-layer.ts","../lib/api/mission-log.ts","../lib/api/mission.ts","../lib/api/oauth.ts","../lib/api/package.ts","../lib/api/profile.ts","../lib/api/query.ts","../lib/api/repeater.ts","../lib/api/security.ts","../lib/api/subscriptions.ts","../lib/api/types.ts","../lib/api/video.ts","../lib/utils/html-error.ts","../lib/utils/queue.ts"],"version":"6.0.3"}

package/lib/api/certificate.ts

@@ -1,4 +1,8 @@
 import Commands from '../commands.js';
+import Err from '@openaddresses/batch-error';
+import { Readable } from 'node:stream';
+import { X509Certificate } from 'node:crypto';
+import { TAKServerError } from '../utils/html-error.js';
 import { Type } from '@sinclair/typebox';
 import type { Static } from '@sinclair/typebox';
 import { TAKItem, TAKList } from './types.js';
@@ -22,6 +26,44 @@ export const Certificate = Type.Object({
 export const TAKList_Certificate = TAKList(Certificate);
 export const TAKItem_Certificate = TAKItem(Certificate);
 
+export const CertificateValidation = Type.Object({
+    fingerprint: Type.String({ description: 'SHA-256 fingerprint of the DER encoded certificate - the TAK Server `hash`' }),
+    subject: Type.String(),
+    username: Type.String({ description: 'Common Name of the certificate subject - the TAK Server `userDn`' }),
+    validFrom: Type.String(),
+    validTo: Type.String(),
+    expired: Type.Boolean({ description: 'validTo is in the past' }),
+    known: Type.Boolean({ description: 'The TAK Server has a record for this fingerprint' }),
+    revoked: Type.Boolean({ description: 'The TAK Server record carries a revocationDate' }),
+    revocationDate: Type.Optional(Type.String({ format: 'date-time' })),
+    valid: Type.Boolean({ description: 'Neither expired nor revoked' }),
+    certificate: Type.Optional(Certificate)
+});
+
+export const CertificateProbe = Type.Object({
+    accepted: Type.Boolean({ description: 'The TAK Server authenticated the credentials' }),
+    version: Type.Optional(Type.String({ description: 'TAK Server version string when accepted' })),
+    reason: Type.Optional(Type.Union([
+        Type.Literal('revoked', { description: 'X509Authenticator raised RevokedException' }),
+        Type.Literal('rejected', { description: 'Authentication failed for another reason (BadCredentialsException)' }),
+        Type.Literal('tls', { description: 'The TLS handshake failed - typically an expired or untrusted client certificate' })
+    ])),
+    message: Type.Optional(Type.String())
+});
+
+/**
+ * Extract the Common Name from an X509 subject string as reported by Node
+ * (newline separated `key=value` pairs)
+ */
+function commonName(subject: string): string | undefined {
+    for (const line of subject.split('\n')) {
+        const [key, ...rest] = line.split('=');
+        if (key.trim() === 'CN') return rest.join('=').trim();
+    }
+
+    return undefined;
+}
+
 export default class CertificateCommands extends Commands {
     schema = {}
 
@@ -46,6 +88,19 @@ export default class CertificateCommands extends Commands {
         return await this.api.fetch(url) as Static<typeof TAKList_Certificate>;
     }
 
+    /**
+     * List Active Certificates
+     *
+     * The most recently issued certificate for each Client UID / User DN pair
+     *
+     * {@link https://docs.tak.gov/api/takserver/redoc#tag/cert-manager-admin-api/operation/getActive TAK Server Docs}.
+     */
+    async listActive(): Promise<Static<typeof TAKList_Certificate>> {
+        const url = new URL('/Marti/api/certadmin/cert/active', this.api.url);
+
+        return await this.api.fetch(url) as Static<typeof TAKList_Certificate>;
+    }
+
     /**
      * List Revoked Certificates
      *
@@ -79,6 +134,105 @@ export default class CertificateCommands extends Commands {
         return await this.api.fetch(url) as Static<typeof TAKList_Certificate>;
     }
 
+    /**
+     * Probe whether the TAK Server accepts the credentials this API instance was created with
+     *
+     * The X509 filter runs on every request and rethrows on failure, so `GET /Marti/api/version`
+     * (an anonymous, DB-free endpoint returning a short string) is the cheapest authoritative
+     * check - unlike {@link validate} it reflects the server's actual enforcement (e.g. whether
+     * `x509checkRevocation` is enabled) and requires no admin credentials. An expired client
+     * certificate is rejected during the TLS handshake and surfaces as `reason: 'tls'`.
+     *
+     * Only authentication failures are returned as a verdict - any other error (server
+     * unreachable, unexpected status) is rethrown so it is not mistaken for a rejection
+     */
+    async probe(): Promise<Static<typeof CertificateProbe>> {
+        const url = new URL('/Marti/api/version', this.api.url);
+
+        try {
+            const version = String(await this.api.fetch(url)).trim();
+
+            return { accepted: true, version };
+        } catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            const details = err instanceof TAKServerError ? err.details : '';
+            const haystack = `${message}\n${details}`;
+
+            let reason: Static<typeof CertificateProbe>['reason'];
+            if (/RevokedException|revoked certificate/i.test(haystack)) {
+                reason = 'revoked';
+            } else if (/BadCredentialsException|AuthenticationException|TAK Server authentication/i.test(haystack)) {
+                reason = 'rejected';
+            } else if (
+                err instanceof Err && err.status === 400 && !(err instanceof TAKServerError)
+                && /certificate|handshake|alert|EPROTO|ECONNRESET|SSL|TLS/i.test(haystack)
+            ) {
+                reason = 'tls';
+            } else {
+                throw err;
+            }
+
+            return { accepted: false, reason, message };
+        }
+    }
+
+    /**
+     * Validate a PEM encoded client certificate against local expiry and the TAK Server revocation record
+     *
+     * Expiry is evaluated locally from the certificate. Revocation is looked up via the
+     * Certificate Admin API using the same SHA-256 fingerprint the TAK Server `X509Authenticator`
+     * consults - `get(hash)` first (a single cached row) falling back to the user's certificate
+     * list when the TAK Server answers 500, which is how it reports an unknown hash.
+     *
+     * Note: The TAK Server only enforces revocation when `auth.x509checkRevocation` (or
+     * `x509TokenAuth`) is enabled in CoreConfig - `revoked` reports the stored state regardless
+     */
+    async validate(
+        pem: string,
+        opts: {
+            now?: Date;
+        } = {}
+    ): Promise<Static<typeof CertificateValidation>> {
+        const x509 = new X509Certificate(pem);
+        const now = opts.now ?? new Date();
+
+        const username = commonName(x509.subject);
+        if (!username) throw new Error('Certificate subject does not contain a Common Name');
+
+        const fingerprint = x509.fingerprint256.toUpperCase();
+
+        let certificate: Static<typeof Certificate> | undefined;
+        try {
+            // Single cached row lookup - the same query X509Authenticator performs
+            certificate = (await this.get(fingerprint)).data;
+        } catch (err) {
+            // The TAK Server reports an unknown hash via sendError(500), which is
+            // indistinguishable from a genuine failure - disambiguate against the
+            // (uncached, but authoritative) list of the user's certificates
+            if (!(err instanceof Err) || err.status < 500) throw err;
+
+            certificate = (await this.list(username)).data
+                .find((cert) => cert.hash.toUpperCase() === fingerprint);
+        }
+
+        const expired = Date.parse(x509.validTo) < now.getTime();
+        const revoked = !!certificate?.revocationDate;
+
+        return {
+            fingerprint,
+            subject: x509.subject,
+            username,
+            validFrom: x509.validFrom,
+            validTo: x509.validTo,
+            expired,
+            known: !!certificate,
+            revoked,
+            revocationDate: certificate?.revocationDate,
+            valid: !expired && !revoked,
+            certificate
+        };
+    }
+
     /**
      * Get Single Certificate
      *
@@ -107,6 +261,36 @@ export default class CertificateCommands extends Commands {
         }) as string;
     }
 
+    /**
+     * Download Certificates by Id
+     *
+     * Returns a ZIP archive stream containing one `{n}_{userDn}_ClientCert.pem` entry per certificate
+     *
+     * {@link https://docs.tak.gov/api/takserver/redoc#tag/cert-manager-admin-api/operation/downloadCertificates TAK Server Docs}.
+     */
+    async downloadIds(
+        ids: Array<string | number>
+    ): Promise<Readable> {
+        if (ids.length === 0) {
+            throw new Error('At least one ID must be provided');
+        }
+
+        const url = new URL(`/Marti/api/certadmin/cert/download/${ids.map((id) => encodeURIComponent(String(id))).join(',')}`, this.api.url);
+
+        const res = await this.api.fetch(url, {
+            method: 'GET'
+        }, true);
+
+        // The raw fetch path skips status validation - without this check a
+        // TAK Server error page would be streamed as if it were the ZIP archive
+        if (res.status < 200 || res.status >= 400) {
+            const body = await res.text().catch(() => '');
+            throw new Err(res.status, null, body || `Status Code: ${res.status}`);
+        }
+
+        return res.body;
+    }
+
     /**
      * Revoke Single Certificate
      *

package/package.json

@@ -1,7 +1,7 @@
 {
     "name": "@tak-ps/node-tak",
     "type": "module",
-    "version": "12.25.0",
+    "version": "12.26.0",
     "description": "Lightweight JavaScript library for communicating with TAK Server",
     "author": "Nick Ingalls <nick@ingalls.ca>",
     "main": "dist/index.js",

package/test/certificate.test.ts

@@ -0,0 +1,339 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { Readable } from 'node:stream';
+import { Client } from 'undici';
+import type { Dispatcher } from 'undici';
+import TAKAPI from '../lib/api.js';
+import { APIAuthCertificate } from '../lib/auth.js';
+
+type RequestArgs = Parameters<Client['request']>[0];
+
+function mockResponse(statusCode: number, contentType: string, body: string | Buffer): Dispatcher.ResponseData {
+    return {
+        statusCode,
+        headers: { 'content-type': contentType },
+        body: Readable.from([Buffer.from(body)]),
+        trailers: {}
+    } as unknown as Dispatcher.ResponseData;
+}
+
+// Self-signed test certificate: O=CO-TAK, OU=WILDFIRE, CN=alice@example.com, expires 2036-08-22
+const FIXTURE_PEM = `-----BEGIN CERTIFICATE-----
+MIIB1TCCAXugAwIBAgIUHPumta9q/l2whKqG1nGD9pJ/uogwCgYIKoZIzj0EAwIw
+QDEPMA0GA1UECgwGQ08tVEFLMREwDwYDVQQLDAhXSUxERklSRTEaMBgGA1UEAwwR
+YWxpY2VAZXhhbXBsZS5jb20wHhcNMjYwODI1MDEwNTQxWhcNMzYwODIyMDEwNTQx
+WjBAMQ8wDQYDVQQKDAZDTy1UQUsxETAPBgNVBAsMCFdJTERGSVJFMRowGAYDVQQD
+DBFhbGljZUBleGFtcGxlLmNvbTBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABB45
+OnCT2nVQVxlgKDLttbhLW9Yjs2/elFjAZkil+iI0QLM+vtRjdoCdI+NhADggvJ65
++++JRYr8Kv2zwv2joSKjUzBRMB0GA1UdDgQWBBS8Depzqkj88/9GNHWY8GmyreFB
+VTAfBgNVHSMEGDAWgBS8Depzqkj88/9GNHWY8GmyreFBVTAPBgNVHRMBAf8EBTAD
+AQH/MAoGCCqGSM49BAMCA0gAMEUCIQCU1mg7e/Eu4A84SemDc0bIQHTnM9aVP8h1
+LaburcgKWwIgYeKSRCQGrM1cEhJQbqJC6UWpJUGxGcclcMzGjqx7WpQ=
+-----END CERTIFICATE-----`;
+const FIXTURE_FINGERPRINT = '37:CA:5A:CD:2E:AC:F5:41:09:4B:DE:21:34:9F:A8:83:C4:43:20:71:7E:7F:CC:EC:97:2C:9E:AE:E9:5F:83:40';
+const GET_PATH = `/Marti/api/certadmin/cert/${FIXTURE_FINGERPRINT}`;
+const LIST_PATH = '/Marti/api/certadmin/cert?username=alice%40example.com';
+
+function certList(certs: object[]): string {
+    return JSON.stringify({ version: '3', type: 'TakCert', data: certs, nodeId: 'node' });
+}
+
+function certItem(cert: object): string {
+    return JSON.stringify({ version: '3', type: 'TakCert', data: cert, nodeId: 'node' });
+}
+
+// Tomcat's default page for response.sendError(500) - what the TAK Server
+// returns from getCertificate() when the hash is unknown
+const TOMCAT_500 = '<!doctype html><html lang="en"><head><title>HTTP Status 500 – Internal Server Error</title></head><body><h1>HTTP Status 500 – Internal Server Error</h1></body></html>';
+
+async function collect(stream: Readable): Promise<Buffer> {
+    const chunks: Buffer[] = [];
+    for await (const chunk of stream) chunks.push(Buffer.from(chunk));
+    return Buffer.concat(chunks);
+}
+
+/**
+ * Install a path-keyed mock; returns the list of paths requested in order
+ */
+function mockRoutes(routes: Record<string, () => Dispatcher.ResponseData>): { paths: string[]; restore: () => void } {
+    const originalRequest = Client.prototype.request;
+    const paths: string[] = [];
+
+    Client.prototype.request = async function(opts: RequestArgs): Promise<Dispatcher.ResponseData> {
+        const path = String(opts.path);
+        paths.push(path);
+        const route = routes[path];
+        if (!route) throw new Error(`Unexpected request: ${opts.method ?? 'GET'} ${path}`);
+        return route();
+    };
+
+    return { paths, restore: () => { Client.prototype.request = originalRequest; } };
+}
+
+function api(): TAKAPI {
+    return new TAKAPI(new URL('https://tak.example.com'), new APIAuthCertificate('cert', 'key'));
+}
+
+test('Certificate.listActive requests the active certificate list', async () => {
+    const mock = mockRoutes({
+        '/Marti/api/certadmin/cert/active': () => mockResponse(200, 'application/json', certList([{ id: 1, hash: 'abc', userDn: 'alice' }]))
+    });
+
+    try {
+        const res = await api().Certificate.listActive();
+
+        assert.deepEqual(mock.paths, ['/Marti/api/certadmin/cert/active']);
+        assert.equal(res.data.length, 1);
+        assert.equal(res.data[0].hash, 'abc');
+    } finally {
+        mock.restore();
+    }
+});
+
+test('Certificate.validate resolves a known certificate with a single get(hash) call', async () => {
+    const mock = mockRoutes({
+        [GET_PATH]: () => mockResponse(200, 'application/json', certItem({ id: 2, hash: FIXTURE_FINGERPRINT, userDn: 'alice@example.com' }))
+    });
+
+    try {
+        const res = await api().Certificate.validate(FIXTURE_PEM);
+
+        assert.deepEqual(mock.paths, [GET_PATH]);
+        assert.equal(res.fingerprint, FIXTURE_FINGERPRINT);
+        assert.equal(res.username, 'alice@example.com');
+        assert.equal(res.expired, false);
+        assert.equal(res.known, true);
+        assert.equal(res.revoked, false);
+        assert.equal(res.revocationDate, undefined);
+        assert.equal(res.valid, true);
+        assert.equal(res.certificate?.id, 2);
+    } finally {
+        mock.restore();
+    }
+});
+
+test('Certificate.validate reports a revoked certificate', async () => {
+    const mock = mockRoutes({
+        [GET_PATH]: () => mockResponse(200, 'application/json', certItem({ id: 2, hash: FIXTURE_FINGERPRINT, userDn: 'alice@example.com', revocationDate: '2026-08-24T21:00:00.000Z' }))
+    });
+
+    try {
+        const res = await api().Certificate.validate(FIXTURE_PEM);
+
+        assert.equal(res.known, true);
+        assert.equal(res.revoked, true);
+        assert.equal(res.revocationDate, '2026-08-24T21:00:00.000Z');
+        assert.equal(res.expired, false);
+        assert.equal(res.valid, false);
+    } finally {
+        mock.restore();
+    }
+});
+
+test('Certificate.validate falls back to the user list when get(hash) answers 500 and matches case-insensitively', async () => {
+    const mock = mockRoutes({
+        [GET_PATH]: () => mockResponse(500, 'text/html', TOMCAT_500),
+        [LIST_PATH]: () => mockResponse(200, 'application/json', certList([
+            { id: 1, hash: 'AA:BB', userDn: 'alice@example.com', revocationDate: '2026-01-01T00:00:00.000Z' },
+            { id: 2, hash: FIXTURE_FINGERPRINT.toLowerCase(), userDn: 'alice@example.com' }
+        ]))
+    });
+
+    try {
+        const res = await api().Certificate.validate(FIXTURE_PEM);
+
+        assert.deepEqual(mock.paths, [GET_PATH, LIST_PATH]);
+        assert.equal(res.known, true);
+        assert.equal(res.revoked, false);
+        assert.equal(res.valid, true);
+        assert.equal(res.certificate?.id, 2);
+    } finally {
+        mock.restore();
+    }
+});
+
+test('Certificate.validate reports an unknown certificate as not revoked but not known', async () => {
+    const mock = mockRoutes({
+        [GET_PATH]: () => mockResponse(500, 'text/html', TOMCAT_500),
+        [LIST_PATH]: () => mockResponse(200, 'application/json', certList([]))
+    });
+
+    try {
+        const res = await api().Certificate.validate(FIXTURE_PEM);
+
+        assert.deepEqual(mock.paths, [GET_PATH, LIST_PATH]);
+        assert.equal(res.known, false);
+        assert.equal(res.revoked, false);
+        assert.equal(res.certificate, undefined);
+        assert.equal(res.valid, true);
+    } finally {
+        mock.restore();
+    }
+});
+
+test('Certificate.validate rethrows non-500 failures from get(hash) without consulting the list', async () => {
+    const mock = mockRoutes({
+        [GET_PATH]: () => mockResponse(403, 'text/plain', 'Forbidden')
+    });
+
+    try {
+        await assert.rejects(() => api().Certificate.validate(FIXTURE_PEM), (err: unknown) => {
+            assert.equal((err as { status?: number }).status, 403);
+            return true;
+        });
+        assert.deepEqual(mock.paths, [GET_PATH]);
+    } finally {
+        mock.restore();
+    }
+});
+
+test('Certificate.validate evaluates expiry locally against the supplied clock', async () => {
+    const mock = mockRoutes({
+        [GET_PATH]: () => mockResponse(200, 'application/json', certItem({ id: 2, hash: FIXTURE_FINGERPRINT, userDn: 'alice@example.com' }))
+    });
+
+    try {
+        const res = await api().Certificate.validate(FIXTURE_PEM, { now: new Date('2040-01-01T00:00:00Z') });
+
+        assert.equal(res.expired, true);
+        assert.equal(res.revoked, false);
+        assert.equal(res.valid, false);
+    } finally {
+        mock.restore();
+    }
+});
+
+test('Certificate.validate rejects a PEM that is not a certificate', async () => {
+    await assert.rejects(() => api().Certificate.validate('not a certificate'));
+});
+
+test('Certificate.probe reports accepted credentials with the server version', async () => {
+    const mock = mockRoutes({
+        '/Marti/api/version': () => mockResponse(200, 'text/plain', 'TAK Server 5.4-RELEASE-1\n')
+    });
+
+    try {
+        const res = await api().Certificate.probe();
+
+        assert.deepEqual(mock.paths, ['/Marti/api/version']);
+        assert.deepEqual(res, { accepted: true, version: 'TAK Server 5.4-RELEASE-1' });
+    } finally {
+        mock.restore();
+    }
+});
+
+test('Certificate.probe classifies a RevokedException error page as revoked', async () => {
+    const mock = mockRoutes({
+        '/Marti/api/version': () => mockResponse(500, 'text/html', [
+            '<!doctype html><html lang="en"><head><title>HTTP Status 500 – Internal Server Error</title></head><body>',
+            '<h1>HTTP Status 500 – Internal Server Error</h1><p><b>Type</b> Exception Report</p>',
+            '<p><b>Message</b> Exception performing TAK Server authentication</p>',
+            '<p><b>Exception</b></p><pre>org.springframework.security.authentication.BadCredentialsException: Exception performing TAK Server authentication</pre>',
+            '<p><b>Root Cause</b></p><pre>com.bbn.marti.remote.exception.RevokedException: Attempt to use revoked certificate : CN=alice@example.com,OU=WILDFIRE,O=CO-TAK</pre>',
+            '</body></html>'
+        ].join(''))
+    });
+
+    try {
+        const res = await api().Certificate.probe();
+
+        assert.equal(res.accepted, false);
+        assert.equal(res.reason, 'revoked');
+        assert.ok(res.message);
+    } finally {
+        mock.restore();
+    }
+});
+
+test('Certificate.probe classifies a BadCredentialsException without a revocation cause as rejected', async () => {
+    const mock = mockRoutes({
+        '/Marti/api/version': () => mockResponse(500, 'text/plain', 'org.springframework.security.authentication.BadCredentialsException: Exception performing TAK Server authentication')
+    });
+
+    try {
+        const res = await api().Certificate.probe();
+
+        assert.equal(res.accepted, false);
+        assert.equal(res.reason, 'rejected');
+    } finally {
+        mock.restore();
+    }
+});
+
+test('Certificate.probe classifies a TLS handshake failure as tls', async () => {
+    const originalRequest = Client.prototype.request;
+
+    Client.prototype.request = async function(): Promise<Dispatcher.ResponseData> {
+        const err = new Error('fetch failed') as Error & { cause?: Error };
+        err.cause = Object.assign(new Error('write EPROTO SSL routines:ssl3_read_bytes:sslv3 alert bad certificate'), { code: 'EPROTO' });
+        throw err;
+    };
+
+    try {
+        const res = await api().Certificate.probe();
+
+        assert.equal(res.accepted, false);
+        assert.equal(res.reason, 'tls');
+        assert.match(res.message ?? '', /EPROTO/);
+    } finally {
+        Client.prototype.request = originalRequest;
+    }
+});
+
+test('Certificate.probe rethrows errors that are not authentication failures', async () => {
+    const mock = mockRoutes({
+        '/Marti/api/version': () => mockResponse(503, 'text/plain', 'Service Unavailable')
+    });
+
+    try {
+        await assert.rejects(() => api().Certificate.probe(), (err: unknown) => {
+            assert.equal((err as { status?: number }).status, 503);
+            return true;
+        });
+    } finally {
+        mock.restore();
+    }
+});
+
+test('Certificate.downloadIds streams the ZIP archive for the given IDs', async () => {
+    const mock = mockRoutes({
+        '/Marti/api/certadmin/cert/download/1,2,3': () => mockResponse(200, 'application/zip', Buffer.from('zip-bytes'))
+    });
+
+    try {
+        const body = await collect(await api().Certificate.downloadIds([1, '2', 3]));
+
+        assert.deepEqual(mock.paths, ['/Marti/api/certadmin/cert/download/1,2,3']);
+        assert.equal(body.toString(), 'zip-bytes');
+    } finally {
+        mock.restore();
+    }
+});
+
+test('Certificate.downloadIds rejects an empty ID list without a request', async () => {
+    const mock = mockRoutes({});
+
+    try {
+        await assert.rejects(() => api().Certificate.downloadIds([]), /At least one ID must be provided/);
+        assert.deepEqual(mock.paths, []);
+    } finally {
+        mock.restore();
+    }
+});
+
+test('Certificate.downloadIds throws on a TAK Server error instead of streaming the error page', async () => {
+    const mock = mockRoutes({
+        '/Marti/api/certadmin/cert/download/1': () => mockResponse(500, 'text/plain', 'exception in downloadCertificates!')
+    });
+
+    try {
+        await assert.rejects(() => api().Certificate.downloadIds([1]), (err: unknown) => {
+            assert.ok(err instanceof Error);
+            assert.equal((err as { status?: number }).status, 500);
+            assert.match(err.message, /downloadCertificates/);
+            return true;
+        });
+    } finally {
+        mock.restore();
+    }
+});