@virtru/dsp-sdk 0.2.4 → 0.3.1

package/src/gen/virtru/policy/objects_pb.ts

@@ -0,0 +1,235 @@
+// @generated by protoc-gen-es v2.3.0 with parameter "target=ts"
+// @generated from file virtru/policy/objects.proto (package virtru.policy, syntax proto3)
+/* eslint-disable */
+
+import type { GenEnum, GenFile, GenMessage } from "@bufbuild/protobuf/codegenv1";
+import { enumDesc, fileDesc, messageDesc } from "@bufbuild/protobuf/codegenv1";
+import { file_buf_validate_validate } from "../../buf/validate/validate_pb";
+import type { Metadata } from "../common/common_pb";
+import { file_virtru_common_common } from "../common/common_pb";
+import type { Message } from "@bufbuild/protobuf";
+
+/**
+ * Describes the file virtru/policy/objects.proto.
+ */
+export const file_virtru_policy_objects: GenFile = /*@__PURE__*/
+  fileDesc("Cht2aXJ0cnUvcG9saWN5L29iamVjdHMucHJvdG8SDXZpcnRydS5wb2xpY3kinwIKC0NlcnRpZmljYXRlEgoKAmlkGAEgASgJEg4KBmtleV9pZBgCIAEoCRIvCg1rZXlfYWxnb3JpdGhtGAMgASgOMhgudmlydHJ1LnBvbGljeS5BbGdvcml0aG0SLAoKa2V5X3N0YXR1cxgEIAEoDjIYLnZpcnRydS5wb2xpY3kuS2V5U3RhdHVzEhQKA3BlbRgFIAEoCUIHukgEcgIQARIVCgRuYW1lGAYgASgJQge6SARyAhABEigKCGtleV9tb2RlGAcgASgOMhYudmlydHJ1LnBvbGljeS5LZXlNb2RlEhMKC2ZpbmdlcnByaW50GAggASgJEikKCG1ldGFkYXRhGGQgASgLMhcudmlydHJ1LmNvbW1vbi5NZXRhZGF0YSKXAQoSQ2VydGlmaWNhdGVNYXBwaW5nEhQKAmlkGAEgASgJQgi6SAVyA7ABARIgCg5jZXJ0aWZpY2F0ZV9pZBgCIAEoCUIIukgFcgOwAQESHgoMbmFtZXNwYWNlX2lkGAMgASgJQgi6SAVyA7ABARIpCghtZXRhZGF0YRhkIAEoCzIXLnZpcnRydS5jb21tb24uTWV0YWRhdGEqmwEKCUFsZ29yaXRobRIZChVBTEdPUklUSE1fVU5TUEVDSUZJRUQQABIWChJBTEdPUklUSE1fUlNBXzIwNDgQARIWChJBTEdPUklUSE1fUlNBXzQwOTYQAhIVChFBTEdPUklUSE1fRUNfUDI1NhADEhUKEUFMR09SSVRITV9FQ19QMzg0EAQSFQoRQUxHT1JJVEhNX0VDX1A1MjEQBSpWCglLZXlTdGF0dXMSGgoWS0VZX1NUQVRVU19VTlNQRUNJRklFRBAAEhUKEUtFWV9TVEFUVVNfQUNUSVZFEAESFgoSS0VZX1NUQVRVU19ST1RBVEVEEAIqlAEKB0tleU1vZGUSGAoUS0VZX01PREVfVU5TUEVDSUZJRUQQABIcChhLRVlfTU9ERV9DT05GSUdfUk9PVF9LRVkQARIeChpLRVlfTU9ERV9QUk9WSURFUl9ST09UX0tFWRACEhMKD0tFWV9NT0RFX1JFTU9URRADEhwKGEtFWV9NT0RFX1BVQkxJQ19LRVlfT05MWRAEQnYKEWNvbS52aXJ0cnUucG9saWN5QgxPYmplY3RzUHJvdG9QAaICA1ZQWKoCDVZpcnRydS5Qb2xpY3nKAg1WaXJ0cnVcUG9saWN54gIZVmlydHJ1XFBvbGljeVxHUEJNZXRhZGF0YeoCDlZpcnRydTo6UG9saWN5YgZwcm90bzM", [file_buf_validate_validate, file_virtru_common_common]);
+
+/**
+ * @generated from message virtru.policy.Certificate
+ */
+export type Certificate = Message<"virtru.policy.Certificate"> & {
+  /**
+   * @generated from field: string id = 1;
+   */
+  id: string;
+
+  /**
+   * @generated from field: string key_id = 2;
+   */
+  keyId: string;
+
+  /**
+   * @generated from field: virtru.policy.Algorithm key_algorithm = 3;
+   */
+  keyAlgorithm: Algorithm;
+
+  /**
+   * @generated from field: virtru.policy.KeyStatus key_status = 4;
+   */
+  keyStatus: KeyStatus;
+
+  /**
+   * @generated from field: string pem = 5;
+   */
+  pem: string;
+
+  /**
+   * The name of the certificate.
+   *
+   * @generated from field: string name = 6;
+   */
+  name: string;
+
+  /**
+   * The key mode of the certificate.
+   *
+   * @generated from field: virtru.policy.KeyMode key_mode = 7;
+   */
+  keyMode: KeyMode;
+
+  /**
+   * The fingerprint of the certificate.
+   *
+   * @generated from field: string fingerprint = 8;
+   */
+  fingerprint: string;
+
+  /**
+   * @generated from field: virtru.common.Metadata metadata = 100;
+   */
+  metadata?: Metadata;
+};
+
+/**
+ * Describes the message virtru.policy.Certificate.
+ * Use `create(CertificateSchema)` to create a new message.
+ */
+export const CertificateSchema: GenMessage<Certificate> = /*@__PURE__*/
+  messageDesc(file_virtru_policy_objects, 0);
+
+/**
+ * @generated from message virtru.policy.CertificateMapping
+ */
+export type CertificateMapping = Message<"virtru.policy.CertificateMapping"> & {
+  /**
+   * @generated from field: string id = 1;
+   */
+  id: string;
+
+  /**
+   * @generated from field: string certificate_id = 2;
+   */
+  certificateId: string;
+
+  /**
+   * @generated from field: string namespace_id = 3;
+   */
+  namespaceId: string;
+
+  /**
+   * @generated from field: virtru.common.Metadata metadata = 100;
+   */
+  metadata?: Metadata;
+};
+
+/**
+ * Describes the message virtru.policy.CertificateMapping.
+ * Use `create(CertificateMappingSchema)` to create a new message.
+ */
+export const CertificateMappingSchema: GenMessage<CertificateMapping> = /*@__PURE__*/
+  messageDesc(file_virtru_policy_objects, 1);
+
+/**
+ * @generated from enum virtru.policy.Algorithm
+ */
+export enum Algorithm {
+  /**
+   * @generated from enum value: ALGORITHM_UNSPECIFIED = 0;
+   */
+  UNSPECIFIED = 0,
+
+  /**
+   * @generated from enum value: ALGORITHM_RSA_2048 = 1;
+   */
+  RSA_2048 = 1,
+
+  /**
+   * @generated from enum value: ALGORITHM_RSA_4096 = 2;
+   */
+  RSA_4096 = 2,
+
+  /**
+   * @generated from enum value: ALGORITHM_EC_P256 = 3;
+   */
+  EC_P256 = 3,
+
+  /**
+   * @generated from enum value: ALGORITHM_EC_P384 = 4;
+   */
+  EC_P384 = 4,
+
+  /**
+   * @generated from enum value: ALGORITHM_EC_P521 = 5;
+   */
+  EC_P521 = 5,
+}
+
+/**
+ * Describes the enum virtru.policy.Algorithm.
+ */
+export const AlgorithmSchema: GenEnum<Algorithm> = /*@__PURE__*/
+  enumDesc(file_virtru_policy_objects, 0);
+
+/**
+ * @generated from enum virtru.policy.KeyStatus
+ */
+export enum KeyStatus {
+  /**
+   * @generated from enum value: KEY_STATUS_UNSPECIFIED = 0;
+   */
+  UNSPECIFIED = 0,
+
+  /**
+   * @generated from enum value: KEY_STATUS_ACTIVE = 1;
+   */
+  ACTIVE = 1,
+
+  /**
+   * @generated from enum value: KEY_STATUS_ROTATED = 2;
+   */
+  ROTATED = 2,
+}
+
+/**
+ * Describes the enum virtru.policy.KeyStatus.
+ */
+export const KeyStatusSchema: GenEnum<KeyStatus> = /*@__PURE__*/
+  enumDesc(file_virtru_policy_objects, 1);
+
+/**
+ * Describes the management and operational mode of a cryptographic key.
+ *
+ * @generated from enum virtru.policy.KeyMode
+ */
+export enum KeyMode {
+  /**
+   * KEY_MODE_UNSPECIFIED: Default, unspecified key mode. Indicates an uninitialized or error state.
+   *
+   * @generated from enum value: KEY_MODE_UNSPECIFIED = 0;
+   */
+  UNSPECIFIED = 0,
+
+  /**
+   * KEY_MODE_CONFIG_ROOT_KEY: Local key management where the private key is wrapped by a Key Encryption Key (KEK)
+   * sourced from local configuration. Unwrapping and all cryptographic operations are performed locally.
+   *
+   * @generated from enum value: KEY_MODE_CONFIG_ROOT_KEY = 1;
+   */
+  CONFIG_ROOT_KEY = 1,
+
+  /**
+   * KEY_MODE_PROVIDER_ROOT_KEY: Local key management where the private key is wrapped by a Key Encryption Key (KEK)
+   * managed by an external provider (e.g., a Hardware Security Module or Cloud KMS).
+   * Key unwrapping is delegated to the external provider; subsequent cryptographic operations
+   * are performed locally using the unwrapped key.
+   *
+   * @generated from enum value: KEY_MODE_PROVIDER_ROOT_KEY = 2;
+   */
+  PROVIDER_ROOT_KEY = 2,
+
+  /**
+   * KEY_MODE_REMOTE: Remote key management where the private key is stored in, and all cryptographic
+   * operations are performed by, a remote Key Management Service (KMS) or HSM.
+   * The private key material never leaves the secure boundary of the remote system.
+   *
+   * @generated from enum value: KEY_MODE_REMOTE = 3;
+   */
+  REMOTE = 3,
+
+  /**
+   * KEY_MODE_PUBLIC_KEY_ONLY: Public key only mode. Used when only a public key is available or required,
+   * typically for wrapping operations (e.g., encrypting a Data Encryption Key (DEK) for an external KAS).
+   * The corresponding private key is not managed or accessible by this system.
+   *
+   * @generated from enum value: KEY_MODE_PUBLIC_KEY_ONLY = 4;
+   */
+  PUBLIC_KEY_ONLY = 4,
+}
+
+/**
+ * Describes the enum virtru.policy.KeyMode.
+ */
+export const KeyModeSchema: GenEnum<KeyMode> = /*@__PURE__*/
+  enumDesc(file_virtru_policy_objects, 2);
+

package/src/index.ts

@@ -22,7 +22,21 @@ export {
   DSPClient,
 } from './lib/client';
 export { PlatformClient } from '@opentdf/sdk/platform';
-export { createAuthInterceptor, type Interceptor } from './lib/utils';
+export {
+  createAuthInterceptor,
+  type Interceptor,
+  createAuthProvider,
+  createOpenTDFClient,
+  getObligations,
+  getUserEntitlements,
+  flattenObligations,
+  getTrustedCertificates,
+  validateJWSCertificateChain,
+  type JWSValidationResult,
+  type ObligationFeatureMap,
+  type SupportedObligations,
+  type GetUserEntitlementsResponse,
+} from './lib/utils';
 
 /**
  * Exports the DSP wrapper of OpenTDF
@@ -46,4 +60,3 @@ export {
 export { AuthProviders, type AuthProvider } from '@opentdf/sdk';
 
 export * as singlecontainer from '@opentdf/sdk/singlecontainer';
-export * as nano from '@opentdf/sdk/nano';

package/src/lib/client.ts

@@ -15,6 +15,7 @@ import { PolicyArtifactService } from '../gen/policyimportexport/v1/policy_impor
 import { SharedService } from '../gen/shared/v1/shared_pb';
 import { TaggingPDPService } from '../gen/tagging/pdp/v2/tagging_pb';
 import { VersionService } from '../gen/version/v1/version_pb';
+import { CertificateService } from '../gen/virtru/policy/certificates/v1/certificates_pb';
 import { createAuthInterceptor } from './utils';
 
 export interface DSPClientServicesV1 {
@@ -22,6 +23,7 @@ export interface DSPClientServicesV1 {
   policyArtifactService: Client<typeof PolicyArtifactService>;
   sharedService: Client<typeof SharedService>;
   versionService: Client<typeof VersionService>;
+  certificateService: Client<typeof CertificateService>;
 }
 
 export interface DSPClientServicesV2 {
@@ -74,6 +76,7 @@ export class DSPClient {
       policyArtifactService: createClient(PolicyArtifactService, transport),
       sharedService: createClient(SharedService, transport),
       versionService: createClient(VersionService, transport),
+      certificateService: createClient(CertificateService, transport),
     };
 
     this.v2 = {

package/src/lib/consts.ts

@@ -0,0 +1,8 @@
+/*
+ * Copyright (c) Virtru Corporation.  All rights reserved.
+ *
+ * Your use of this file is governed by the Virtu Terms of Service <https://www.virtru.com/terms-of-service/>.
+ */
+
+export const MAX_CERTS = 10; // reasonable upper bound for chain depth
+export const MAX_CERT_BYTES = 64 * 1024; // 64KB per certificate

package/src/lib/utils.test.ts

@@ -0,0 +1,376 @@
+/*
+ * Copyright (c) Virtru Corporation.  All rights reserved.
+ *
+ * Your use of this file is governed by the Virtu Terms of Service <https://www.virtru.com/terms-of-service/>.
+ */
+
+import { describe, it, expect, beforeEach, vi } from 'vitest';
+
+// Mock all @opentdf imports BEFORE importing utils
+vi.mock('@opentdf/sdk', () => ({
+  AuthProviders: {
+    refreshAuthProvider: vi.fn()
+  },
+  OpenTDF: vi.fn(),
+  PermissionDeniedError: class PermissionDeniedError extends Error {}
+}));
+
+vi.mock('@opentdf/sdk/platform', () => ({
+  PlatformClient: vi.fn()
+}));
+
+vi.mock('@opentdf/sdk/platform/policy/objects_pb.js', () => ({
+  Certificate: class Certificate {
+    pem?: string;
+    constructor(data?: any) {
+      if (data) Object.assign(this, data);
+    }
+  }
+}));
+
+vi.mock('@opentdf/sdk/platform/common/common_pb.js', () => ({
+  ActiveStateEnum: {
+    ACTIVE: 1
+  }
+}));
+
+// Polyfill atob if needed
+if (typeof (globalThis as any).atob === 'undefined') {
+  (globalThis as any).atob = (b64: string) => Buffer.from(b64, 'base64').toString('binary');
+}
+
+// Mock pkijs/asn1js with a way to control them
+const mockState = {
+  asn1Mode: 'ok' as 'ok' | 'bad-der',
+  verifyResult: { result: true } as { result: boolean; resultMessage?: string },
+};
+
+vi.mock('asn1js', () => ({
+  fromBER: vi.fn((_: ArrayBuffer) => {
+    if (mockState.asn1Mode === 'bad-der') return { offset: -1 };
+    return { offset: 0, result: { subject: { typesAndValues: [] }, issuer: { typesAndValues: [] } } };
+  }),
+}));
+
+vi.mock('pkijs', () => {
+  return {
+    Certificate: class Certificate {
+      public subject: any = { typesAndValues: [] };
+      public issuer: any = { typesAndValues: [] };
+      public subjectPublicKeyInfo: any = {};
+      constructor(_: any) {}
+    },
+    CertificateChainValidationEngine: class CertificateChainValidationEngine {
+      constructor(_: any) {}
+      async verify() {
+        return mockState.verifyResult;
+      }
+    }
+  };
+});
+
+// Mock DSPClient
+vi.mock('./client', () => ({
+  DSPClient: vi.fn()
+}));
+
+// NOW import utils
+import { validateJWSCertificateChain, getTrustedCertificates } from './utils';
+import { DSPClient } from './client';
+import { PlatformClient } from '@opentdf/sdk/platform';
+import { AuthProviders } from '@opentdf/sdk';
+
+describe('validateJWSCertificateChain', () => {
+  beforeEach(() => {
+    mockState.asn1Mode = 'ok';
+    mockState.verifyResult = { result: true };
+  });
+
+  it('throws error when x5c is empty', async () => {
+    await expect(validateJWSCertificateChain([], [{ pem: '---' }] as any))
+      .rejects.toThrow(/No certificates provided in x5c array/);
+  });
+
+  it('throws error when too many certificates in x5c', async () => {
+    const tooMany = new Array(11).fill('AQI=');
+    await expect(validateJWSCertificateChain(tooMany, [{ pem: '---' }] as any))
+      .rejects.toThrow(/Too many certificates in x5c/);
+  });
+
+  it('throws error when no trusted roots provided', async () => {
+    await expect(validateJWSCertificateChain(['AQI='], [] as any))
+      .rejects.toThrow(/No trusted root certificates provided/);
+  });
+
+  it('fails on invalid base64 in x5c', async () => {
+    await expect(validateJWSCertificateChain(['***not-base64***'], [{ pem: '---' }] as any))
+      .rejects.toThrow(/Failed to parse certificate at x5c\[0]/);
+  });
+
+  it('fails on ASN.1 parse error', async () => {
+    mockState.asn1Mode = 'bad-der';
+    await expect(validateJWSCertificateChain(['AQI='], [{ pem: '---' }] as any))
+      .rejects.toThrow(/Invalid DER encoding/);
+  });
+
+  it('returns valid true on successful verification', async () => {
+    const pem = '-----BEGIN CERTIFICATE-----\nAQI=\n-----END CERTIFICATE-----';
+    mockState.verifyResult = { result: true };
+    const res = await validateJWSCertificateChain(['AQI='], [{ pem }] as any);
+    expect(res.valid).toBe(true);
+    expect(res.validationResult.warnings).toEqual([]);
+  });
+
+  it('returns warnings when some trusted roots fail to parse', async () => {
+    const pem = '-----BEGIN CERTIFICATE-----\nAQI=\n-----END CERTIFICATE-----';
+    const res = await validateJWSCertificateChain(['AQI='], [{ pem: '' }, { pem }] as any);
+    expect(res.valid).toBe(true);
+    expect(res.validationResult.warnings).toHaveLength(1);
+    expect(res.validationResult.warnings[0]).toMatch(/has no PEM data/);
+  });
+});
+
+describe('getTrustedCertificates', () => {
+  const mockOptions = {
+    oidc: {
+      clientId: 'test-client-id',
+      tokenEndpoint: 'https://auth.test.com/token',
+      userInfoEndpoint: 'https://auth.test.com/userinfo',
+    },
+    platformEndpoint: 'https://platform.test.com',
+    refreshToken: 'test-refresh-token',
+  };
+
+  let mockAuthProvider: any;
+  let mockPlatformClient: any;
+  let mockDSPClient: any;
+  let mockCertificateService: any;
+
+  beforeEach(() => {
+    vi.clearAllMocks();
+
+    // Mock crypto.subtle.generateKey for DPoP signing keys
+    if (!globalThis.crypto) {
+      (globalThis as any).crypto = {};
+    }
+    if (!globalThis.crypto.subtle) {
+      (globalThis.crypto as any).subtle = {};
+    }
+    (globalThis.crypto.subtle as any).generateKey = vi.fn().mockResolvedValue({
+      publicKey: {},
+      privateKey: {},
+    });
+
+    // Mock auth provider
+    mockAuthProvider = {
+      updateClientPublicKey: vi.fn().mockResolvedValue(undefined),
+    };
+
+    (AuthProviders.refreshAuthProvider as any).mockResolvedValue(mockAuthProvider);
+
+    // Mock certificate service
+    mockCertificateService = {
+      listCertificatesByNamespace: vi.fn(),
+    };
+
+    // Mock DSP client
+    mockDSPClient = {
+      v1: {
+        certificateService: mockCertificateService,
+      },
+    };
+
+    (DSPClient as any).mockImplementation(() => mockDSPClient);
+
+    // Mock platform client
+    mockPlatformClient = {
+      v1: {
+        namespace: {
+          listNamespaces: vi.fn(),
+        },
+      },
+    };
+
+    (PlatformClient as any).mockImplementation(() => mockPlatformClient);
+  });
+
+  it('successfully retrieves certificates from a single namespace', async () => {
+    const mockCertificate1 = { pem: 'cert1-pem-data' };
+    const mockCertificate2 = { pem: 'cert2-pem-data' };
+
+    mockPlatformClient.v1.namespace.listNamespaces.mockResolvedValue({
+      namespaces: [{ id: 'namespace-1' }],
+    });
+
+    mockCertificateService.listCertificatesByNamespace.mockResolvedValue({
+      certificates: [mockCertificate1, mockCertificate2],
+      pagination: { nextOffset: 0 },
+    });
+
+    const result = await getTrustedCertificates(mockOptions);
+
+    expect(result).toHaveLength(2);
+    expect(result).toEqual([mockCertificate1, mockCertificate2]);
+    expect(mockCertificateService.listCertificatesByNamespace).toHaveBeenCalledWith({
+      namespaceId: 'namespace-1',
+      pagination: { limit: (100), offset: (0) },
+    });
+  });
+
+  it('successfully retrieves certificates from multiple namespaces', async () => {
+    const mockCert1 = { pem: 'cert1-pem' };
+    const mockCert2 = { pem: 'cert2-pem' };
+    const mockCert3 = { pem: 'cert3-pem' };
+
+    mockPlatformClient.v1.namespace.listNamespaces.mockResolvedValue({
+      namespaces: [{ id: 'namespace-1' }, { id: 'namespace-2' }],
+    });
+
+    mockCertificateService.listCertificatesByNamespace
+      .mockResolvedValueOnce({
+        certificates: [mockCert1, mockCert2],
+        pagination: { nextOffset: (0) },
+      })
+      .mockResolvedValueOnce({
+        certificates: [mockCert3],
+        pagination: { nextOffset: (0) },
+      });
+
+    const result = await getTrustedCertificates(mockOptions);
+
+    expect(result).toHaveLength(3);
+    expect(result).toEqual([mockCert1, mockCert2, mockCert3]);
+    expect(mockCertificateService.listCertificatesByNamespace).toHaveBeenCalledTimes(2);
+  });
+
+  it('handles pagination correctly (multiple pages)', async () => {
+    const mockCert1 = { pem: 'cert1' };
+    const mockCert2 = { pem: 'cert2' };
+    const mockCert3 = { pem: 'cert3' };
+
+    mockPlatformClient.v1.namespace.listNamespaces.mockResolvedValue({
+      namespaces: [{ id: 'namespace-1' }],
+    });
+
+    // First page
+    mockCertificateService.listCertificatesByNamespace
+      .mockResolvedValueOnce({
+        certificates: [mockCert1, mockCert2],
+        pagination: { nextOffset: (100) },
+      })
+      // Second page
+      .mockResolvedValueOnce({
+        certificates: [mockCert3],
+        pagination: { nextOffset: (0) },
+      });
+
+    const result = await getTrustedCertificates(mockOptions);
+
+    expect(result).toHaveLength(3);
+    expect(result).toEqual([mockCert1, mockCert2, mockCert3]);
+    expect(mockCertificateService.listCertificatesByNamespace).toHaveBeenCalledTimes(2);
+    expect(mockCertificateService.listCertificatesByNamespace).toHaveBeenNthCalledWith(1, {
+      namespaceId: 'namespace-1',
+      pagination: { limit: (100), offset: (0) },
+    });
+    expect(mockCertificateService.listCertificatesByNamespace).toHaveBeenNthCalledWith(2, {
+      namespaceId: 'namespace-1',
+      pagination: { limit: (100), offset: (100) },
+    });
+  });
+
+  it('handles empty certificate list', async () => {
+    mockPlatformClient.v1.namespace.listNamespaces.mockResolvedValue({
+      namespaces: [{ id: 'namespace-1' }],
+    });
+
+    mockCertificateService.listCertificatesByNamespace.mockResolvedValue({
+      certificates: [],
+      pagination: { nextOffset: (0) },
+    });
+
+    const result = await getTrustedCertificates(mockOptions);
+
+    expect(result).toHaveLength(0);
+    expect(result).toEqual([]);
+  });
+
+  it('handles errors from certificate service', async () => {
+    mockPlatformClient.v1.namespace.listNamespaces.mockResolvedValue({
+      namespaces: [{ id: 'namespace-1' }],
+    });
+
+    mockCertificateService.listCertificatesByNamespace.mockRejectedValue(
+      new Error('Certificate service error')
+    );
+
+    await expect(getTrustedCertificates(mockOptions)).rejects.toThrow('Certificate service error');
+  });
+
+  it('handles errors from namespace listing', async () => {
+    mockPlatformClient.v1.namespace.listNamespaces.mockRejectedValue(
+      new Error('Namespace listing error')
+    );
+
+    await expect(getTrustedCertificates(mockOptions)).rejects.toThrow('Namespace listing error');
+  });
+
+  it('initializes auth provider correctly', async () => {
+    mockPlatformClient.v1.namespace.listNamespaces.mockResolvedValue({
+      namespaces: [],
+    });
+
+    await getTrustedCertificates(mockOptions);
+
+    expect(AuthProviders.refreshAuthProvider).toHaveBeenCalled();
+    expect(mockAuthProvider.updateClientPublicKey).toHaveBeenCalled();
+    expect(globalThis.crypto.subtle.generateKey).toHaveBeenCalledWith(
+      {
+        name: 'ECDSA',
+        namedCurve: 'P-256',
+      },
+      true,
+      ['sign', 'verify']
+    );
+  });
+
+  it('creates both PlatformClient and DSPClient with correct config', async () => {
+    mockPlatformClient.v1.namespace.listNamespaces.mockResolvedValue({
+      namespaces: [],
+    });
+
+    await getTrustedCertificates(mockOptions);
+
+    expect(PlatformClient).toHaveBeenCalledWith({
+      authProvider: mockAuthProvider,
+      platformUrl: mockOptions.platformEndpoint,
+    });
+
+    expect(DSPClient).toHaveBeenCalledWith({
+      platformUrl: mockOptions.platformEndpoint,
+      authProvider: mockAuthProvider,
+    });
+  });
+
+  it('returns same Certificate type compatible with validateJWSCertificateChain', async () => {
+    const mockCert = { pem: '-----BEGIN CERTIFICATE-----\nAQI=\n-----END CERTIFICATE-----' };
+
+    mockPlatformClient.v1.namespace.listNamespaces.mockResolvedValue({
+      namespaces: [{ id: 'namespace-1' }],
+    });
+
+    mockCertificateService.listCertificatesByNamespace.mockResolvedValue({
+      certificates: [mockCert],
+      pagination: { nextOffset: (0) },
+    });
+
+    const result = await getTrustedCertificates(mockOptions);
+
+    // Verify the result can be used with validateJWSCertificateChain
+    expect(result[0].pem).toBeDefined();
+
+    // Integration test: verify compatibility with validateJWSCertificateChain
+    const validationResult = await validateJWSCertificateChain(['AQI='], result);
+    expect(validationResult.valid).toBe(true);
+  });
+});