tylerg/auth-yes
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(spire_ffi): silence noisy cert parse error on invalid certs and add SPIFFE cert unit test

Browse Source
This commit is contained in:
Tyler Gillispie 2026-08-23 10:58:40 -07:00
parent 3e0eb7d9d7
commit e7f01940b3
2 changed files with 45 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

43
server/spire_ffi.test.ts
View File

@ -1,4 +1,5 @@
import { assertEquals } from "jsr:@std/assert"; import { assertEquals } from "jsr:@std/assert";
import { Extension, X509CertificateGenerator } from "npm:@peculiar/x509";
import { extractSpiffeIdFromCert, fetchSpiffeIdentity } from "./spire_ffi.ts"; import { extractSpiffeIdFromCert, fetchSpiffeIdentity } from "./spire_ffi.ts";
Deno.test("SPIRE FFI Test - fetchSpiffeIdentity mock", async () => { Deno.test("SPIRE FFI Test - fetchSpiffeIdentity mock", async () => {
@ -6,7 +7,43 @@ Deno.test("SPIRE FFI Test - fetchSpiffeIdentity mock", async () => {
assertEquals(result.spiffe_id, "spiffe://local.dev/mock"); assertEquals(result.spiffe_id, "spiffe://local.dev/mock");
}); });
Deno.test("SPIRE FFI Test - extractSpiffeIdFromCert null case", () => { Deno.test("SPIRE FFI Test - extractSpiffeIdFromCert null/invalid cases", () => {
const result = extractSpiffeIdFromCert("invalid-cert-string"); assertEquals(extractSpiffeIdFromCert(""), null);
assertEquals(result, null); assertEquals(extractSpiffeIdFromCert(null as any), null);
assertEquals(extractSpiffeIdFromCert("invalid-cert-string"), null);
});
Deno.test("SPIRE FFI Test - extractSpiffeIdFromCert valid SPIFFE certificate", async () => {
const keys = await crypto.subtle.generateKey(
{ name: "ECDSA", namedCurve: "P-256" },
true,
["sign", "verify"],
);
const spiffeUri = "spiffe://system.local/workload/api";
const uriBytes = new TextEncoder().encode(spiffeUri);
const extValue = new Uint8Array([
0x30,
uriBytes.length + 2,
0x86,
uriBytes.length,
...uriBytes,
]).buffer;
const cert = await X509CertificateGenerator.createSelfSigned({
serialNumber: "01",
name: "CN=Test Workload",
notBefore: new Date(),
notAfter: new Date(Date.now() + 3600000),
keys,
signingAlgorithm: { name: "ECDSA", hash: "SHA-256" },
extensions: [
new Extension("2.5.29.17", false, extValue),
],
});
const pem = cert.toString("pem");
const extracted = extractSpiffeIdFromCert(pem);
assertEquals(extracted, spiffeUri);
}); });

7
server/spire_ffi.ts
View File

@ -154,6 +154,10 @@ export async function fetchSpiffeIdentity(
export let extractSpiffeIdFromCert = function extractSpiffeIdFromCert( export let extractSpiffeIdFromCert = function extractSpiffeIdFromCert(
certBundle: string, certBundle: string,
): string | null { ): string | null {
if (!certBundle || typeof certBundle !== "string") {
return null;
}
try { try {
const cert = new X509Certificate(certBundle); const cert = new X509Certificate(certBundle);
const sanExtension = cert.extensions.find((ext) => const sanExtension = cert.extensions.find((ext) =>
@ -173,8 +177,7 @@ export let extractSpiffeIdFromCert = function extractSpiffeIdFromCert(
return name.uniformResourceIdentifier; return name.uniformResourceIdentifier;
} }
} }
} catch (e) { } catch (_e) {
console.error("Failed to parse certificate:", e);
return null; return null;
} }