源码快照 @ 2026-09-02 (source-only, 剔除非源码素材)

packaging/helm/openwork-ee/tests/custom-ca-node-trust.mjs

@@ -0,0 +1,147 @@
+import { spawn, spawnSync } from "node:child_process";
+import { createServer } from "node:https";
+import { mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+const tmp = mkdtempSync(join(tmpdir(), "openwork-custom-ca-"));
+const caKey = join(tmp, "ca.key");
+const caCert = join(tmp, "ca.crt");
+const serverKey = join(tmp, "server.key");
+const serverCsr = join(tmp, "server.csr");
+const serverCert = join(tmp, "server.crt");
+const opensslConfig = join(tmp, "openssl.cnf");
+
+function runOpenSsl(args) {
+  const result = spawnSync("openssl", args, { encoding: "utf8" });
+  if (result.status !== 0) {
+    throw new Error(`openssl ${args.join(" ")} failed\n${result.stderr}`);
+  }
+}
+
+function clientEnvironment(caPath) {
+  const env = { ...process.env };
+  delete env.NODE_EXTRA_CA_CERTS;
+  delete env.NODE_TLS_REJECT_UNAUTHORIZED;
+  if (caPath) {
+    env.NODE_EXTRA_CA_CERTS = caPath;
+  }
+  return env;
+}
+
+function runClient(url, caPath) {
+  const clientSource = `
+const https = require("node:https");
+https.get(process.argv[1], (response) => {
+  let body = "";
+  response.setEncoding("utf8");
+  response.on("data", (chunk) => { body += chunk; });
+  response.on("end", () => {
+    if (response.statusCode === 200 && body === "openwork-custom-ca-ok") {
+      console.log(body);
+      process.exit(0);
+    }
+    console.error(\`unexpected response: \${response.statusCode} \${body}\`);
+    process.exit(1);
+  });
+}).on("error", (error) => {
+  console.error(error.code || error.message);
+  process.exit(2);
+});
+`;
+
+  return new Promise((resolve) => {
+    const child = spawn(process.execPath, ["-e", clientSource, url], {
+      env: clientEnvironment(caPath),
+      stdio: ["ignore", "pipe", "pipe"],
+    });
+    let stdout = "";
+    let stderr = "";
+    child.stdout.on("data", (chunk) => {
+      stdout += chunk;
+    });
+    child.stderr.on("data", (chunk) => {
+      stderr += chunk;
+    });
+    child.on("close", (status) => {
+      resolve({ status, stdout, stderr });
+    });
+  });
+}
+
+function listen(server) {
+  return new Promise((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(0, "127.0.0.1", () => {
+      server.off("error", reject);
+      resolve();
+    });
+  });
+}
+
+function close(server) {
+  return new Promise((resolve, reject) => {
+    server.close((error) => {
+      if (error) {
+        reject(error);
+      } else {
+        resolve();
+      }
+    });
+  });
+}
+
+try {
+  writeFileSync(
+    opensslConfig,
+    `[req]
+distinguished_name = dn
+prompt = no
+[dn]
+CN = localhost
+[v3_req]
+subjectAltName = @alt_names
+[alt_names]
+DNS.1 = localhost
+IP.1 = 127.0.0.1
+`,
+  );
+
+  runOpenSsl(["req", "-x509", "-newkey", "rsa:2048", "-nodes", "-days", "1", "-subj", "/CN=OpenWork Test CA", "-keyout", caKey, "-out", caCert]);
+  runOpenSsl(["req", "-newkey", "rsa:2048", "-nodes", "-keyout", serverKey, "-out", serverCsr, "-config", opensslConfig]);
+  runOpenSsl(["x509", "-req", "-in", serverCsr, "-CA", caCert, "-CAkey", caKey, "-CAcreateserial", "-out", serverCert, "-days", "1", "-extensions", "v3_req", "-extfile", opensslConfig]);
+
+  const server = createServer(
+    {
+      key: readFileSync(serverKey),
+      cert: readFileSync(serverCert),
+    },
+    (_request, response) => {
+      response.end("openwork-custom-ca-ok");
+    },
+  );
+
+  await listen(server);
+  const address = server.address();
+  const url = `https://127.0.0.1:${address.port}/`;
+
+  try {
+    const withoutCustomCa = await runClient(url);
+    if (withoutCustomCa.status === 0) {
+      throw new Error("Strict TLS unexpectedly trusted the private CA without NODE_EXTRA_CA_CERTS");
+    }
+
+    const withCustomCa = await runClient(url, caCert);
+    if (withCustomCa.status !== 0) {
+      throw new Error(`Strict TLS did not trust NODE_EXTRA_CA_CERTS=${caCert}\n${withCustomCa.stderr}`);
+    }
+
+    console.log(`Strict TLS without NODE_EXTRA_CA_CERTS: rejected (${withoutCustomCa.stderr.trim()})`);
+    console.log(`Strict TLS with NODE_EXTRA_CA_CERTS=${caCert}: accepted (${withCustomCa.stdout.trim()})`);
+    console.log("Focused runtime trust check passed; this verifies Node's strict TLS trust path without starting MySQL.");
+  } finally {
+    await close(server);
+  }
+} finally {
+  rmSync(tmp, { recursive: true, force: true });
+}