50 lines
1.6 KiB
TypeScript
50 lines
1.6 KiB
TypeScript
import { assertEquals } from "jsr:@std/assert";
|
|
import { Extension, X509CertificateGenerator } from "npm:@peculiar/x509";
|
|
import { extractSpiffeIdFromCert, fetchSpiffeIdentity } from "./spire_ffi.ts";
|
|
|
|
Deno.test("SPIRE FFI Test - fetchSpiffeIdentity mock", async () => {
|
|
const result = await fetchSpiffeIdentity();
|
|
assertEquals(result.spiffe_id, "spiffe://local.dev/mock");
|
|
});
|
|
|
|
Deno.test("SPIRE FFI Test - extractSpiffeIdFromCert null/invalid cases", () => {
|
|
assertEquals(extractSpiffeIdFromCert(""), null);
|
|
assertEquals(extractSpiffeIdFromCert(null as any), null);
|
|
assertEquals(extractSpiffeIdFromCert("invalid-cert-string"), null);
|
|
});
|
|
|
|
Deno.test("SPIRE FFI Test - extractSpiffeIdFromCert valid SPIFFE certificate", async () => {
|
|
const keys = await crypto.subtle.generateKey(
|
|
{ name: "ECDSA", namedCurve: "P-256" },
|
|
true,
|
|
["sign", "verify"],
|
|
);
|
|
|
|
const spiffeUri = "spiffe://system.local/workload/api";
|
|
const uriBytes = new TextEncoder().encode(spiffeUri);
|
|
|
|
const extValue = new Uint8Array([
|
|
0x30,
|
|
uriBytes.length + 2,
|
|
0x86,
|
|
uriBytes.length,
|
|
...uriBytes,
|
|
]).buffer;
|
|
|
|
const cert = await X509CertificateGenerator.createSelfSigned({
|
|
serialNumber: "01",
|
|
name: "CN=Test Workload",
|
|
notBefore: new Date(),
|
|
notAfter: new Date(Date.now() + 3600000),
|
|
keys,
|
|
signingAlgorithm: { name: "ECDSA", hash: "SHA-256" },
|
|
extensions: [
|
|
new Extension("2.5.29.17", false, extValue),
|
|
],
|
|
});
|
|
|
|
const pem = cert.toString("pem");
|
|
const extracted = extractSpiffeIdFromCert(pem);
|
|
assertEquals(extracted, spiffeUri);
|
|
});
|