From e7f01940b31e9a13f155123af6286fde4de8c074 Mon Sep 17 00:00:00 2001
From: Tyler Gillispie <mrteye@gmail.com>
Date: Sun, 23 Aug 2026 10:58:40 -0700
Subject: [PATCH] fix(spire_ffi): silence noisy cert parse error on invalid
 certs and add SPIFFE cert unit test

---
 server/spire_ffi.test.ts | 43 +++++++++++++++++++++++++++++++++++++---
 server/spire_ffi.ts      |  7 +++++--
 2 files changed, 45 insertions(+), 5 deletions(-)

diff --git a/server/spire_ffi.test.ts b/server/spire_ffi.test.ts
index 2f346e4..530e9e7 100644
--- a/server/spire_ffi.test.ts
+++ b/server/spire_ffi.test.ts
@@ -1,4 +1,5 @@
 import { assertEquals } from "jsr:@std/assert";
+import { Extension, X509CertificateGenerator } from "npm:@peculiar/x509";
 import { extractSpiffeIdFromCert, fetchSpiffeIdentity } from "./spire_ffi.ts";
 
 Deno.test("SPIRE FFI Test - fetchSpiffeIdentity mock", async () => {
@@ -6,7 +7,43 @@ Deno.test("SPIRE FFI Test - fetchSpiffeIdentity mock", async () => {
   assertEquals(result.spiffe_id, "spiffe://local.dev/mock");
 });
 
-Deno.test("SPIRE FFI Test - extractSpiffeIdFromCert null case", () => {
-  const result = extractSpiffeIdFromCert("invalid-cert-string");
-  assertEquals(result, null);
+Deno.test("SPIRE FFI Test - extractSpiffeIdFromCert null/invalid cases", () => {
+  assertEquals(extractSpiffeIdFromCert(""), null);
+  assertEquals(extractSpiffeIdFromCert(null as any), null);
+  assertEquals(extractSpiffeIdFromCert("invalid-cert-string"), null);
+});
+
+Deno.test("SPIRE FFI Test - extractSpiffeIdFromCert valid SPIFFE certificate", async () => {
+  const keys = await crypto.subtle.generateKey(
+    { name: "ECDSA", namedCurve: "P-256" },
+    true,
+    ["sign", "verify"],
+  );
+
+  const spiffeUri = "spiffe://system.local/workload/api";
+  const uriBytes = new TextEncoder().encode(spiffeUri);
+
+  const extValue = new Uint8Array([
+    0x30,
+    uriBytes.length + 2,
+    0x86,
+    uriBytes.length,
+    ...uriBytes,
+  ]).buffer;
+
+  const cert = await X509CertificateGenerator.createSelfSigned({
+    serialNumber: "01",
+    name: "CN=Test Workload",
+    notBefore: new Date(),
+    notAfter: new Date(Date.now() + 3600000),
+    keys,
+    signingAlgorithm: { name: "ECDSA", hash: "SHA-256" },
+    extensions: [
+      new Extension("2.5.29.17", false, extValue),
+    ],
+  });
+
+  const pem = cert.toString("pem");
+  const extracted = extractSpiffeIdFromCert(pem);
+  assertEquals(extracted, spiffeUri);
 });
diff --git a/server/spire_ffi.ts b/server/spire_ffi.ts
index 5e92bc6..b6d12a2 100644
--- a/server/spire_ffi.ts
+++ b/server/spire_ffi.ts
@@ -154,6 +154,10 @@ export async function fetchSpiffeIdentity(
 export let extractSpiffeIdFromCert = function extractSpiffeIdFromCert(
   certBundle: string,
 ): string | null {
+  if (!certBundle || typeof certBundle !== "string") {
+    return null;
+  }
+
   try {
     const cert = new X509Certificate(certBundle);
     const sanExtension = cert.extensions.find((ext) =>
@@ -173,8 +177,7 @@ export let extractSpiffeIdFromCert = function extractSpiffeIdFromCert(
         return name.uniformResourceIdentifier;
       }
     }
-  } catch (e) {
-    console.error("Failed to parse certificate:", e);
+  } catch (_e) {
     return null;
   }