import { CA_CERT_PATH , OPENSEARCH_KEY_PATH , OPENSEARCH_CERT_PATH , OPENSEARCH_P12_PATH , OPENSEARCH_P12_PASSWORD , OPENSEARCH_EMPTYPASSWORD_P12_PATH , OPENSEARCH_NOPASSWORD_P12_PATH , } from '@osd/dev-utils' ; import { NO_CA_PATH , NO_CERT_PATH , NO_KEY_PATH , TWO_CAS_PATH , TWO_KEYS_PATH } from './__fixtures__' ; import { readFileSync } from 'fs' ; import { readPkcs12Keystore , Pkcs12ReadResult , readPkcs12Truststore } from './index' ; const reformatPem = ( pem ) => { return pem . replace ( /\r\n/g , '\n' ) . trim ( ) ; } ; const readPem = ( file ) => { const raw = readFileSync ( file , 'utf8' ) ; const pem = raw . substr ( raw . indexOf ( '-----BEGIN' ) ) ; return reformatPem ( pem ) ; } ; let pemCA ; let pemCert ; let pemKey ; beforeAll ( ( ) => { pemCA = readPem ( CA_CERT_PATH ) ; pemCert = readPem ( OPENSEARCH_CERT_PATH ) ; pemKey = readPem ( OPENSEARCH_KEY_PATH ) ; } ) ; describe . skip ( '#readPkcs12Keystore' , ( ) => { const expectKey = ( pkcs12ReadResult ) => { const result = reformatPem ( pkcs12ReadResult . key ! ) ; expect ( result ) . toEqual ( pemKey ) ; } ; const expectCert = ( pkcs12ReadResult ) => { const result = reformatPem ( pkcs12ReadResult . cert ! ) ; expect ( result ) . toEqual ( pemCert ) ; } ; const expectCA = ( pkcs12ReadResult , ca = [ pemCA ] ) => { const result = pkcs12ReadResult . ca ?. map ( ( x ) => reformatPem ( x ) ) ; expect ( result ) . toEqual ( ca ) ; } ; describe ( 'Succeeds when the correct password is used' , ( ) => { let pkcs12ReadResult ; beforeAll ( ( ) => { pkcs12ReadResult = readPkcs12Keystore ( OPENSEARCH_P12_PATH , OPENSEARCH_P12_PASSWORD ) ; } ) ; it ( 'Extracts the PEM key' , ( ) => { expectKey ( pkcs12ReadResult ) ; } ) ; it ( 'Extracts the PEM instance certificate' , ( ) => { expectCert ( pkcs12ReadResult ) ; } ) ; it ( 'Extracts the PEM CA certificate' , ( ) => { expectCA ( pkcs12ReadResult ) ; } ) ; } ) ; describe ( 'Succeeds on a key store with an empty password' , ( ) => { let pkcs12ReadResult ; beforeAll ( ( ) => { pkcs12ReadResult = readPkcs12Keystore ( OPENSEARCH_EMPTYPASSWORD_P12_PATH , '' ) ; } ) ; it ( 'Extracts the PEM key' , ( ) => { expectKey ( pkcs12ReadResult ) ; } ) ; it ( 'Extracts the PEM instance certificate' , ( ) => { expectCert ( pkcs12ReadResult ) ; } ) ; it ( 'Extracts the PEM CA certificate' , ( ) => { expectCA ( pkcs12ReadResult ) ; } ) ; } ) ; describe ( 'Succeeds on a key store with no password' , ( ) => { let pkcs12ReadResult ; beforeAll ( ( ) => { pkcs12ReadResult = readPkcs12Keystore ( OPENSEARCH_NOPASSWORD_P12_PATH ) ; } ) ; it ( 'Extracts the PEM key' , ( ) => { expectKey ( pkcs12ReadResult ) ; } ) ; it ( 'Extracts the PEM instance certificate' , ( ) => { expectCert ( pkcs12ReadResult ) ; } ) ; it ( 'Extracts the PEM CA certificate' , ( ) => { expectCA ( pkcs12ReadResult ) ; } ) ; } ) ; describe ( 'Handles other key store permutations' , ( ) => { it ( 'Succeeds with no key' , ( ) => { const pkcs12ReadResult = readPkcs12Keystore ( NO_KEY_PATH , '' ) ; expectCA ( pkcs12ReadResult , [ pemCert , pemCA ] ) ; expect ( pkcs12ReadResult . cert ) . toBeUndefined ( ) ; expect ( pkcs12ReadResult . key ) . toBeUndefined ( ) ; } ) ; it ( 'Succeeds with no instance certificate' , ( ) => { const pkcs12ReadResult = readPkcs12Keystore ( NO_CERT_PATH , '' ) ; expectCA ( pkcs12ReadResult ) ; expect ( pkcs12ReadResult . cert ) . toBeUndefined ( ) ; expectKey ( pkcs12ReadResult ) ; } ) ; it ( 'Succeeds with no CA certificate' , ( ) => { const pkcs12ReadResult = readPkcs12Keystore ( NO_CA_PATH , '' ) ; expect ( pkcs12ReadResult . ca ) . toBeUndefined ( ) ; expectCert ( pkcs12ReadResult ) ; expectKey ( pkcs12ReadResult ) ; } ) ; it ( 'Succeeds with two CA certificates' , ( ) => { const pkcs12ReadResult = readPkcs12Keystore ( TWO_CAS_PATH , '' ) ; expectCA ( pkcs12ReadResult , [ pemCA , pemCA ] ) ; expectCert ( pkcs12ReadResult ) ; expectKey ( pkcs12ReadResult ) ; } ) ; } ) ; describe ( 'Throws errors' , ( ) => { const expectError = ( password ? ) => { expect ( ( ) => readPkcs12Keystore ( OPENSEARCH_P12_PATH , password ) ) . toThrowError ( 'PKCS#12 MAC could not be verified. Invalid password?' ) ; } ; it ( 'When an invalid password is used (incorrect)' , ( ) => { expectError ( 'incorrect' ) ; } ) ; it ( 'When an invalid password is used (empty)' , ( ) => { expectError ( '' ) ; } ) ; it ( 'When an invalid password is used (undefined)' , ( ) => { expectError ( ) ; } ) ; it ( 'When an invalid file path is used' , ( ) => { const path = 'invalid-filepath' ; expect ( ( ) => readPkcs12Keystore ( path ) ) . toThrowError ( `ENOENT: no such file or directory, open '${ path }'` ) ; } ) ; it ( 'When two keys are present' , ( ) => { expect ( ( ) => readPkcs12Keystore ( TWO_KEYS_PATH , '' ) ) . toThrowError ( 'Keystore contains multiple private keys.' ) ; } ) ; } ) ; } ) ; describe . skip ( '#readPkcs12Truststore' , ( ) => { it ( 'reads all certificates into one CA array and discards any certificates that have keys' , ( ) => { const ca = readPkcs12Truststore ( OPENSEARCH_P12_PATH , OPENSEARCH_P12_PASSWORD ) ; const result = ca ?. map ( ( x ) => reformatPem ( x ) ) ; expect ( result ) . toEqual ( [ pemCA ] ) ; } ) ; } ) ;