node-opcua-pki 6.12.1 → 6.13.0

package/dist/bin/pki.mjs

@@ -384,9 +384,10 @@ function short(stringToShorten) {
   return stringToShorten.substring(0, 10);
 }
 function buildIdealCertificateName(certificate) {
-  const fingerprint2 = makeFingerprint(certificate);
+  const chain = coerceCertificateChain(certificate);
+  const fingerprint2 = makeFingerprint(chain);
   try {
-    const commonName = exploreCertificate(certificate).tbsCertificate.subject.commonName || "";
+    const commonName = exploreCertificate(chain[0]).tbsCertificate.subject.commonName || "";
     const sanitizedCommonName = commonName.replace(forbiddenChars, "_");
     return `${sanitizedCommonName}[${fingerprint2}]`;
   } catch (_err) {
@@ -454,7 +455,7 @@ function findIssuerCertificateInChain(certificate, chain) {
   }
   return null;
 }
-var configurationFileSimpleTemplate, fsWriteFile, forbiddenChars, CertificateManager;
+var configurationFileSimpleTemplate, fsWriteFile, forbiddenChars, ChainCompletionStatus, CertificateManager;
 var init_certificate_manager = __esm({
   "packages/node-opcua-pki/lib/pki/certificate_manager.ts"() {
     "use strict";
@@ -466,6 +467,14 @@ var init_certificate_manager = __esm({
     configurationFileSimpleTemplate = simple_config_template_cnf_default;
     fsWriteFile = fs4.promises.writeFile;
     forbiddenChars = /[\x00-\x1F<>:"/\\|?*]/g;
+    ChainCompletionStatus = /* @__PURE__ */ ((ChainCompletionStatus2) => {
+      ChainCompletionStatus2["AlreadyComplete"] = "AlreadyComplete";
+      ChainCompletionStatus2["ChainCompleted"] = "ChainCompleted";
+      ChainCompletionStatus2["IssuerNotFound"] = "IssuerNotFound";
+      ChainCompletionStatus2["EmptyChain"] = "EmptyChain";
+      ChainCompletionStatus2["MaxDepthReached"] = "MaxDepthReached";
+      return ChainCompletionStatus2;
+    })(ChainCompletionStatus || {});
     CertificateManager = class _CertificateManager extends EventEmitter {
       // ── Global instance registry ─────────────────────────────────
       // Tracks all initialized CertificateManager instances so their
@@ -558,6 +567,7 @@ var init_certificate_manager = __esm({
       #filenameToHash = /* @__PURE__ */ new Map();
       #initializingPromise;
       #addCertValidation;
+      #disableFileWatchers;
       #thumbs = {
         rejected: /* @__PURE__ */ new Map(),
         trusted: /* @__PURE__ */ new Map(),
@@ -591,6 +601,7 @@ var init_certificate_manager = __esm({
           ignoreMissingRevocationList: v.ignoreMissingRevocationList ?? false,
           maxChainLength: v.maxChainLength ?? 5
         };
+        this.#disableFileWatchers = options.disableFileWatchers ?? process.env.OPCUA_PKI_DISABLE_FILE_WATCHERS === "true";
         mkdirRecursiveSync(options.location);
         if (!fs4.existsSync(this.#location)) {
           throw new Error(`CertificateManager cannot access location ${this.#location}`);
@@ -615,18 +626,18 @@ var init_certificate_manager = __esm({
       /**
        * Move a certificate to the rejected store.
        * If the certificate was previously trusted, it will be removed from the trusted folder.
-       * @param certificate - the DER-encoded certificate
+       * @param certificateOrChain - the DER-encoded certificate or certificate chain
        */
-      async rejectCertificate(certificate) {
-        await this.#moveCertificate(certificate, "rejected");
+      async rejectCertificate(certificateOrChain) {
+        await this.#moveCertificate(certificateOrChain, "rejected");
       }
       /**
        * Move a certificate to the trusted store.
        * If the certificate was previously rejected, it will be removed from the rejected folder.
-       * @param certificate - the DER-encoded certificate
+       * @param certificateOrChain - the DER-encoded certificate or certificate chain
        */
-      async trustCertificate(certificate) {
-        await this.#moveCertificate(certificate, "trusted");
+      async trustCertificate(certificateOrChain) {
+        await this.#moveCertificate(certificateOrChain, "trusted");
       }
       /**
        * Check whether the trusted certificate store is empty.
@@ -680,31 +691,40 @@ var init_certificate_manager = __esm({
        * @returns `"Good"` if trusted, `"BadCertificateUntrusted"` if rejected/unknown,
        *   or `"BadCertificateInvalid"` if the certificate cannot be parsed.
        */
-      async isCertificateTrusted(certificate) {
-        let fingerprint2;
+      async isCertificateTrusted(certificateOrCertificateChain) {
         try {
-          fingerprint2 = makeFingerprint(certificate);
-        } catch (_err) {
-          return "BadCertificateInvalid";
-        }
-        if (this.#thumbs.trusted.has(fingerprint2)) {
-          return "Good";
-        }
-        if (!this.#thumbs.rejected.has(fingerprint2)) {
-          if (!this.untrustUnknownCertificate) {
-            return "Good";
+          const chain = coerceCertificateChain(certificateOrCertificateChain);
+          const leafCertificate = chain[0];
+          if (chain.length < 1) {
+            return "BadCertificateInvalid";
           }
+          let fingerprint2;
           try {
-            exploreCertificateInfo(certificate);
+            fingerprint2 = makeFingerprint(chain[0]);
           } catch (_err) {
             return "BadCertificateInvalid";
           }
-          const filename = path2.join(this.rejectedFolder, `${buildIdealCertificateName(certificate)}.pem`);
-          debugLog("certificate has never been seen before and is now rejected (untrusted) ", filename);
-          await fsWriteFile(filename, toPem(certificate, "CERTIFICATE"));
-          this.#thumbs.rejected.set(fingerprint2, { certificate, filename });
+          if (this.#thumbs.trusted.has(fingerprint2)) {
+            return "Good";
+          }
+          if (!this.#thumbs.rejected.has(fingerprint2)) {
+            if (!this.untrustUnknownCertificate) {
+              return "Good";
+            }
+            try {
+              exploreCertificateInfo(chain[0]);
+            } catch (_err) {
+              return "BadCertificateInvalid";
+            }
+            const filename = path2.join(this.rejectedFolder, `${buildIdealCertificateName(leafCertificate)}.pem`);
+            debugLog("certificate has never been seen before and is now rejected (untrusted) ", filename);
+            await fsWriteFile(filename, toPem(chain, "CERTIFICATE"));
+            this.#thumbs.rejected.set(fingerprint2, { certificate: leafCertificate, filename });
+          }
+          return "BadCertificateUntrusted";
+        } catch (_err) {
+          return "BadCertificateInvalid";
         }
-        return "BadCertificateUntrusted";
       }
       async #innerVerifyCertificateAsync(certificateOrChain, _isIssuer, level, options) {
         if (level >= 5) {
@@ -1374,7 +1394,7 @@ var init_certificate_manager = __esm({
             return "BadCertificateInvalid" /* BadCertificateInvalid */;
           }
         }
-        await this.trustCertificate(leafCertificate);
+        await this.trustCertificate(certificates);
         return "Good" /* Good */;
       }
       /**
@@ -1446,6 +1466,75 @@ var init_certificate_manager = __esm({
         }
         return selectedTrustedCertificates.length > 0 ? selectedTrustedCertificates[0].certificate : null;
       }
+      /**
+       * Outcome status for {@link CertificateManager.completeCertificateChain}.
+       */
+      static ChainCompletionStatus = ChainCompletionStatus;
+      /**
+       * Complete a certificate chain by walking the issuer store.
+       *
+       * Starting from the last certificate in the provided chain, this method
+       * repeatedly calls {@link findIssuerCertificate} to locate the parent
+       * certificate until it reaches a self-signed root or can no longer find
+       * an issuer.
+       *
+       * @param chain - the (potentially partial) certificate chain, leaf first
+       * @param maxDepth - maximum number of issuers to append (default: 10)
+       * @returns a {@link ChainCompletionResult} containing the (possibly completed)
+       *          chain, a status code, and an optional diagnostic message.
+       */
+      async completeCertificateChain(chain, maxDepth = 10) {
+        if (chain.length === 0) {
+          return {
+            chain,
+            status: "EmptyChain" /* EmptyChain */,
+            message: "Input chain is empty \u2014 nothing to complete."
+          };
+        }
+        await this.#scanCertFolder(this.issuersCertFolder, this.#thumbs.issuers.certs);
+        const result = [...chain];
+        let depth = 0;
+        while (depth < maxDepth) {
+          const lastCert = result[result.length - 1];
+          const lastInfo = exploreCertificate(lastCert);
+          if (isSelfSigned2(lastInfo)) {
+            const wasExtended = result.length > chain.length;
+            return {
+              chain: result,
+              status: wasExtended ? "ChainCompleted" /* ChainCompleted */ : "AlreadyComplete" /* AlreadyComplete */,
+              message: wasExtended ? `Chain completed: ${result.length - chain.length} issuer(s) appended, ending at self-signed root "${lastInfo.tbsCertificate.subject.commonName}".` : `Chain is already complete (self-signed root "${lastInfo.tbsCertificate.subject.commonName}").`
+            };
+          }
+          const issuerCert = await this.findIssuerCertificate(lastCert);
+          if (!issuerCert) {
+            const cn = lastInfo.tbsCertificate.subject.commonName ?? "?";
+            const akid = lastInfo.tbsCertificate.extensions?.authorityKeyIdentifier?.keyIdentifier ?? "?";
+            const msg = `Cannot find issuer for "${cn}" (authorityKeyIdentifier: ${akid}). Ensure the CA certificate is present in the issuers/certs folder.`;
+            warningLog(`completeCertificateChain: ${msg}`);
+            return {
+              chain: result,
+              status: "IssuerNotFound" /* IssuerNotFound */,
+              message: msg
+            };
+          }
+          const issuerFingerprint = makeFingerprint(issuerCert);
+          const alreadyInChain = result.some((c) => makeFingerprint(c) === issuerFingerprint);
+          if (alreadyInChain) {
+            return {
+              chain: result,
+              status: "AlreadyComplete" /* AlreadyComplete */,
+              message: `Chain ends at root "${exploreCertificate(issuerCert).tbsCertificate.subject.commonName}" (already present in chain).`
+            };
+          }
+          result.push(issuerCert);
+          depth++;
+        }
+        return {
+          chain: result,
+          status: "MaxDepthReached" /* MaxDepthReached */,
+          message: `Chain completion stopped after ${maxDepth} iterations \u2014 possible circular chain or very deep hierarchy.`
+        };
+      }
       /**
        *
        * check if the certificate explicitly appear in the trust list, the reject list or none.
@@ -1466,12 +1555,14 @@ var init_certificate_manager = __esm({
         }
         return "unknown";
       }
-      async #moveCertificate(certificate, newStatus) {
+      async #moveCertificate(certificateOrChain, newStatus) {
         await this.withLock2(async () => {
+          const chain = coerceCertificateChain(certificateOrChain);
+          const certificate = chain[0];
           const fingerprint2 = makeFingerprint(certificate);
           let status = await this.#checkRejectedOrTrusted(certificate);
           if (status === "unknown") {
-            const pem = toPem(certificate, "CERTIFICATE");
+            const pem = toPem(chain, "CERTIFICATE");
             const filename = path2.join(this.rejectedFolder, `${buildIdealCertificateName(certificate)}.pem`);
             await fs4.promises.writeFile(filename, pem);
             this.#thumbs.rejected.set(fingerprint2, { certificate, filename });
@@ -1639,11 +1730,15 @@ var init_certificate_manager = __esm({
           this.#scanCrlFolder(this.crlFolder, this.#thumbs.crl),
           this.#scanCrlFolder(this.issuersCrlFolder, this.#thumbs.issuersCrl)
         ]);
-        this.#startWatcher(this.trustedFolder, this.#thumbs.trusted, createUnreffedWatcher, "trusted");
-        this.#startWatcher(this.issuersCertFolder, this.#thumbs.issuers.certs, createUnreffedWatcher, "issuersCerts");
-        this.#startWatcher(this.rejectedFolder, this.#thumbs.rejected, createUnreffedWatcher, "rejected");
-        this.#startCrlWatcher(this.crlFolder, this.#thumbs.crl, createUnreffedWatcher, "crl");
-        this.#startCrlWatcher(this.issuersCrlFolder, this.#thumbs.issuersCrl, createUnreffedWatcher, "issuersCrl");
+        if (this.#disableFileWatchers) {
+          fs4.watch = origWatch;
+        } else {
+          this.#startWatcher(this.trustedFolder, this.#thumbs.trusted, createUnreffedWatcher, "trusted");
+          this.#startWatcher(this.issuersCertFolder, this.#thumbs.issuers.certs, createUnreffedWatcher, "issuersCerts");
+          this.#startWatcher(this.rejectedFolder, this.#thumbs.rejected, createUnreffedWatcher, "rejected");
+          this.#startCrlWatcher(this.crlFolder, this.#thumbs.crl, createUnreffedWatcher, "crl");
+          this.#startCrlWatcher(this.issuersCrlFolder, this.#thumbs.issuersCrl, createUnreffedWatcher, "issuersCrl");
+        }
       }
       /**
        * Scan a certificate folder and populate the in-memory index.
@@ -1658,7 +1753,25 @@ var init_certificate_manager = __esm({
           try {
             const stat = await fs4.promises.stat(filename);
             if (!stat.isFile()) continue;
-            const certificate = (await readCertificateChainAsync(filename))[0];
+            const certs = await readCertificateChainAsync(filename);
+            if (certs.length === 0) continue;
+            const certificate = certs[0];
+            if (certs.length > 1) {
+              try {
+                await fs4.promises.writeFile(filename, toPem(certs, "CERTIFICATE"), "ascii");
+              } catch (writeErr) {
+                debugLog(`scanCertFolder: could not rewrite legacy PEM ${filename} (read-only fs?)`, writeErr);
+              }
+              for (let i = 1; i < certs.length; i++) {
+                if (isIssuer(certs[i])) {
+                  try {
+                    await this.addIssuer(certs[i]);
+                  } catch (issuerErr) {
+                    debugLog(`scanCertFolder: could not auto-register issuer from ${filename}`, issuerErr);
+                  }
+                }
+              }
+            }
             const info = exploreCertificate(certificate);
             const fingerprint2 = makeFingerprint(certificate);
             index.set(fingerprint2, { certificate, filename, info });