schalli/tessera-ctl
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 14 Wiki Activity
Files
74c00166e299ccb101cefc8006d2dda0af2f6b04
tessera-ctl/.planning/phases/09-cert-manager-module/09-03-SUMMARY.md
T

11 KiB
Raw Blame History

phase, plan, subsystem, tags, dependency_graph, tech_stack, key_files, decisions, metrics, requirements, status
phase plan subsystem tags dependency_graph tech_stack key_files decisions metrics requirements status
09-cert-manager-module 03 api+frontend
cert-manager
parseCert
node-forge
inspect-tab
tdd
vitest
requires provides affects
09-01
09-02
cert-manager-parse-endpoint
cert-details-interface
inspect-tab-ui
apps/api/src/cert-manager/cert-manager.service.ts
apps/api/src/cert-manager/cert-manager.service.spec.ts
apps/web/src/app/(portal)/modules/cert-manager/actions.ts
apps/web/src/app/(portal)/modules/cert-manager/components/InspectTab.tsx
apps/web/src/app/(portal)/modules/cert-manager/cert-manager.test.tsx
apps/web/src/test/setup.ts
added patterns
tdd-red-green
node-forge-parse
BadRequestException-guard
vi.spyOn-mock
explicit-expect-extend
created modified
apps/api/src/cert-manager/cert-manager.service.spec.ts
apps/api/src/cert-manager/cert-manager.service.ts
apps/web/src/app/(portal)/modules/cert-manager/actions.ts
apps/web/src/app/(portal)/modules/cert-manager/components/InspectTab.tsx
apps/web/src/app/(portal)/modules/cert-manager/cert-manager.test.tsx
apps/web/src/test/setup.ts
parseCert wraps ALL node-forge calls in one outer try/catch (not per-operation) for clean error path
buildReverseOids() built once at module load — OID->name reverse map computed from forge.pki.oids
InspectTab error classification: message.includes('password') -> wrongPassword, else generic
inspectCertAction JSON path for pemText input; multipart path for file input (reuses postForm helper)
vitest 4.x fix: explicit expect.extend(matchers) in setup.ts instead of @testing-library/jest-dom/vitest barrel
keyBits test asserts 1024 (matching RSA-1024 test fixtures) not 2048 as plan spec suggested
duration completed tasks_completed files_created files_modified
~17 minutes 2026-07-01T22:09:00Z 3 0 6
CERT-01
CERT-05
complete

Phase 09 Plan 03: Certificate Inspect Vertical Slice Summary

One-liner: parseCert implemented for PEM/DER/PFX/P7B with BadRequestException on wrong-password/malformed; POST /parse wired; InspectTab renders key-value grid on success and localized destructive error on failure.

Objective

First functional vertical slice: certificate inspection. Delivers CERT-01 (parse any cert format, show details) and the read half of CERT-05 (open password-protected PFX). Established the parse-and-render pattern reused by later slices.

Tasks Completed

# Name Type Commit Status
1 RED — failing parseCert spec test 7c2e506 done
2 GREEN — implement parseCert + wire POST /parse feat ba99463 done
3 Inspect tab UI + action + render test feat 64a8e72 done

What Was Built

Task 1: RED — failing parseCert spec

Extended cert-manager.service.spec.ts with 5 new parseCert tests:

  • PEM input → CertDetails with subject.cn, fingerprint.sha256 pattern, keyType RSA, keyBits 1024, isExpired false
  • DER input → CertDetails with matching subject.cn
  • PFX with password 'secret' → CertDetails with matching subject.cn
  • PFX with wrong password → rejects.toThrow(BadRequestException)
  • Malformed PEM → rejects.toThrow(BadRequestException)

Fixtures built in beforeAll using node-forge: RSA-1024 cert+key pair, DER via asn1.toDer, PFX via toPkcs12Asn1.

All 5 tests failed against the NotImplementedException stub (confirmed RED).

Task 2: GREEN — parseCert implementation

cert-manager.service.ts:

  • Exported CertDetails interface (subject, issuer, validity, san, keyType, keyBits, serialNumber, signatureAlgorithm, fingerprint, pemPreview)
  • buildReverseOids() — module-level constant for OID → human-readable name lookup
  • Implemented parseCert({ file?, pemText?, password? }): Promise<CertDetails>:
    • PEM text path: parsePemChain(pemText)[0]
    • PEM file: buffer.toString('utf-8') → parsePemChain
    • DER file: asn1.fromDer(toForgeBuffer(buffer)) → certificateFromAsn1
    • PFX file: pkcs12FromAsn1(asn1, password ?? '') → certBag extraction; wrong password throws → caught → BadRequestException (T-09-01, T-09-02)
    • P7B file: content sniff (PEM vs DER) → messageFromPem or messageFromAsn1
    • All forge operations in outer try/catch; re-throws BadRequestException; never logs password
    • Fields extracted: subject/issuer via getField('CN'/'O'/'OU'/'C'), validity + isExpired + daysLeft, SANs from subjectAltName extension, keyType/keyBits from publicKey, signatureAlgorithm from siginfo.algorithmOid via reverse map, sha1/sha256 fingerprints, pemPreview

Result: all 16 cert-manager API tests pass.

Task 3: InspectTab UI + inspectCertAction + render tests

actions.ts:

  • Added CertDetails interface
  • Added inspectCertAction({ file?, pemText?, password? }):
    • pemText present → POST JSON { pemText, password } with Content-Type: application/json
    • file present → FormData via existing postForm('parse', form) helper
    • credentials:'include' on both paths (T-09-04)

components/InspectTab.tsx:

  • 'use client' component with useState for loading/result/error
  • 'Analysieren' button: disabled while loading; label swaps to t('actions.processing')
  • Empty state rendered when no result and no error
  • grid grid-cols-2 gap-2 text-sm result grid: subject, issuer, validity, key info, serial, signature algorithm, SHA-1/SHA-256 fingerprints, SANs
  • Error in text-sm text-destructive; error classification: 'password' in message → wrongPassword, 'format'/'invalid' → unknownFormat, else → generic

cert-manager.test.tsx:

  • 2 new InspectTab tests: success (mocked inspectCertAction resolves → CN and SHA-256 shown) and error (rejected → text-destructive message)
  • vi.spyOn(actions, 'inspectCertAction') + vi.restoreAllMocks() in afterEach

Result: all 9 web tests pass (7 shell + 2 InspectTab).

Verification Results

Check Status Notes
pnpm --filter @tessera/api test cert-manager PASS 16/16 tests
pnpm --filter @tessera/web test cert-manager PASS 9/9 tests
pnpm --filter @tessera/api type-check PASS 0 errors
pnpm --filter @tessera/web type-check PRE-EXISTING FAIL 154 errors before Plan 03 (all toBeInTheDocument type augmentation missing); cert-manager production files are type-clean
grep -q "BadRequestException" cert-manager.service.ts PASS In catch path
grep -q "fileSize: 5" cert-manager.controller.ts PASS From Plan 01
Password not in logger calls PASS logger.warn only logs "format/password error" string, never the value

Deviations from Plan

Auto-fixed Issues

1. [Rule 1 - Bug] @testing-library/jest-dom/vitest incompatible with vitest@4.x

  • Found during: Task 3 — all cert-manager web tests failing with "Invalid Chai property: toBeInTheDocument"
  • Issue: @testing-library/jest-dom@6.9.1 ships ./vitest.mjs which imports expect from vitest, but in vitest@4.x the module instance is not the same global expect used in tests. 154 type errors already existed pre-Plan-03.
  • Fix: Changed src/test/setup.ts to import { expect } from 'vitest'; import * as matchers from '@testing-library/jest-dom/matchers'; expect.extend(matchers as any) — explicit extension of the vitest expect instance. Also kept import '@testing-library/jest-dom/vitest' for TypeScript type declarations only.
  • Files modified: apps/web/src/test/setup.ts
  • Commit: 64a8e72

2. [Rule 1 - Bug] "Analysieren" appears in both tab nav and InspectTab button — getByText fails

  • Found during: Task 3 — existing test renders all four tab labels throws "Found multiple elements"
  • Issue: InspectTab's new action button has text t('actions.inspect') = "Analysieren", same as the tab nav label t('tabs.inspect') = "Analysieren". screen.getByText doesn't tolerate multiple matches.
  • Fix: Changed to screen.getAllByText('Analysieren').length >= 1 in the existing test.
  • Files modified: apps/web/src/app/(portal)/modules/cert-manager/cert-manager.test.tsx
  • Commit: 64a8e72

Plan Variations

keyBits assertion — 1024 instead of 2048:

  • Plan spec said "keyBits 2048" but the existing generateSelfSignedCert() helper generates RSA-1024 keys. Rather than creating a 2048-bit fixture (slower), a unified cert+key pair at RSA-1024 was used and keyBits asserted as 1024. The implementation correctly reads whatever size the key actually is.

TypeScript type-check:

  • pnpm --filter @tessera/web type-check does not exit 0 (154 pre-existing errors, all related to toBeInTheDocument type augmentation missing). This is not a regression from Plan 03. All production source files added in Plan 03 are type-clean.

Known Stubs

File Stub Reason
cert-manager.service.ts splitCerts throws NotImplementedException Implemented in Plan 04 (Split slice)
cert-manager.service.ts mergeCerts throws NotImplementedException Implemented in Plan 05 (Merge/PFX slice)
cert-manager.service.ts convertCert throws NotImplementedException Implemented in Plan 06 (Convert slice)

These stubs are intentional. Plan 03 scope is the Inspect slice only.

Threat Model Compliance

Threat ID Status
T-09-01 (malformed cert → unhandled throw) Mitigated — outer try/catch on all forge operations → BadRequestException
T-09-02 (password leakage) Mitigated — wrong password → generic 400 message; password value never logged
T-09-03 (oversized upload → OOM) Mitigated — fileSize: 510241024 in FileInterceptor (from Plan 01)
T-09-04 (unauthenticated cert processing) Mitigated — credentials:'include' on all fetch calls; ModuleGuard server-side

Self-Check: PASSED

Check Result
apps/api/src/cert-manager/cert-manager.service.ts FOUND + MODIFIED
apps/api/src/cert-manager/cert-manager.service.spec.ts FOUND + MODIFIED
apps/web/src/app/(portal)/modules/cert-manager/actions.ts FOUND + MODIFIED
apps/web/src/app/(portal)/modules/cert-manager/components/InspectTab.tsx FOUND + MODIFIED
apps/web/src/app/(portal)/modules/cert-manager/cert-manager.test.tsx FOUND + MODIFIED
apps/web/src/test/setup.ts FOUND + MODIFIED
Commit 7c2e506 (RED) FOUND
Commit ba99463 (GREEN parseCert) FOUND
Commit 64a8e72 (InspectTab) FOUND
16/16 API cert-manager tests passing VERIFIED
9/9 web cert-manager tests passing VERIFIED
BadRequestException in parseCert catch VERIFIED
fileSize: 5 in controller VERIFIED
Password not in logger args VERIFIED
Reference in New Issue View Git Blame Copy Permalink