Release Crypto Tools 0.2.0

2026-09-02 10:40:23 +02:00
parent 4b75f819e2
commit 82bb01b13f
37 changed files with 3673 additions and 140 deletions
@@ -1,4 +1,12 @@
 import { describe, expect, it } from "vitest";
+import {
+  AuthorityKeyIdentifierExtension,
+  BasicConstraintsExtension,
+  KeyUsageFlags,
+  KeyUsagesExtension,
+  SubjectKeyIdentifierExtension,
+  X509CertificateGenerator,
+} from "@peculiar/x509";
 import {
  checkCertificateHostname,
  inspectCryptoInput,
@@ -70,4 +78,74 @@ describe("crypto input inspection", () => {
      false,
    );
  });
+
+  it("builds an explicitly untrusted path with signature and CA checks", async () => {
+    const algorithm = {
+      name: "ECDSA",
+      namedCurve: "P-256",
+      hash: "SHA-256",
+    } as const;
+    const rootKeys = await crypto.subtle.generateKey(
+      { name: "ECDSA", namedCurve: "P-256" },
+      true,
+      ["sign", "verify"],
+    );
+    const root = await X509CertificateGenerator.createSelfSigned(
+      {
+        serialNumber: "01",
+        name: "CN=Local Test Root",
+        notBefore: new Date("2029-01-01T00:00:00Z"),
+        notAfter: new Date("2035-01-01T00:00:00Z"),
+        signingAlgorithm: algorithm,
+        keys: rootKeys,
+        extensions: [
+          new BasicConstraintsExtension(true, 1, true),
+          new KeyUsagesExtension(
+            KeyUsageFlags.keyCertSign | KeyUsageFlags.cRLSign,
+            true,
+          ),
+          await SubjectKeyIdentifierExtension.create(rootKeys.publicKey),
+        ],
+      },
+      crypto,
+    );
+    const leafKeys = await crypto.subtle.generateKey(
+      { name: "ECDSA", namedCurve: "P-256" },
+      true,
+      ["sign", "verify"],
+    );
+    const leaf = await X509CertificateGenerator.create(
+      {
+        serialNumber: "02",
+        subject: "CN=Leaf",
+        issuer: root.subject,
+        notBefore: new Date("2029-01-01T00:00:00Z"),
+        notAfter: new Date("2031-01-01T00:00:00Z"),
+        signingAlgorithm: algorithm,
+        publicKey: leafKeys.publicKey,
+        signingKey: rootKeys.privateKey,
+        extensions: [
+          new BasicConstraintsExtension(false, undefined, true),
+          await AuthorityKeyIdentifierExtension.create(rootKeys.publicKey),
+        ],
+      },
+      crypto,
+    );
+    const inspection = await inspectCryptoInput(
+      `${leaf.toString("pem")}\n${root.toString("pem")}`,
+      new Date("2030-01-01T00:00:00Z"),
+    );
+    expect(inspection.paths).toHaveLength(1);
+    expect(inspection.paths[0]).toMatchObject({
+      status: "self-signed-anchor-present",
+      trusted: false,
+      certificates: ["CN=Leaf", "CN=Local Test Root"],
+    });
+    expect(inspection.paths[0]?.links[0]).toMatchObject({
+      signatureValid: true,
+      issuerIsCa: true,
+      keyCertSignAllowed: true,
+      authorityKeyIdentifierMatched: true,
+    });
+  });
 });