// Schema-level tests for gateway.tls certPath and keyPath validation.

import { describe, expect, it } from "vitest";

import { validateConfigObject } from "./validation.js";

describe("gateway.tls schema", () => {

it("rejects empty certPath", () => {

const res = validateConfigObject({ gateway: { tls: { enabled: true, certPath: "" } } });

expect(res.ok).toBe(false);

if (!res.ok) {

expect(res.issues[0]?.path).toMatch(/certPath/);

}

});

it("rejects whitespace-only keyPath", () => {

const res = validateConfigObject({ gateway: { tls: { enabled: true, keyPath: " " } } });

expect(res.ok).toBe(false);

});

it("accepts a non-empty certPath", () => {

const res = validateConfigObject({

gateway: { tls: { enabled: true, certPath: "/etc/ssl/cert.pem" } },

});

expect(res.ok).toBe(true);

});

it("preserves exact bytes of a non-empty certPath (no silent trim)", () => {

const res = validateConfigObject({

gateway: { tls: { enabled: true, certPath: " /etc/ssl/cert.pem " } },

});

expect(res.ok).toBe(true);

if (res.ok) {

// Schema must validate without transforming the string; runtime path

// resolution owns normalization, so leading/trailing spaces are preserved.

expect(res.config.gateway?.tls?.certPath).toBe(" /etc/ssl/cert.pem ");

}

});

it("preserves exact bytes of a non-empty keyPath (no silent trim)", () => {

const res = validateConfigObject({

gateway: { tls: { enabled: true, keyPath: " /etc/ssl/private/server.key " } },

});

expect(res.ok).toBe(true);

if (res.ok) {

expect(res.config.gateway?.tls?.keyPath).toBe(" /etc/ssl/private/server.key ");

}

});

});

.object({

enabled: z.boolean().optional(),

autoGenerate: z.boolean().optional(),

certPath: z.string().optional(),

keyPath: z.string().optional(),

// Reject blank values without transforming the string. Trimming here would

// silently rewrite a legitimate filesystem path that contains leading or

// trailing spaces and persist the trimmed value into validated config;

// runtime path resolution (resolveUserPath) owns all normalization.

certPath: z

.string()

.optional()

.refine((v) => v === undefined || v.trim().length > 0, "certPath must not be blank"),

keyPath: z

.string()

.optional()

.refine((v) => v === undefined || v.trim().length > 0, "keyPath must not be blank"),

caPath: z.string().optional(),

})

.optional(),

expect(result.keyPath).toBe(keyPath);

expect(result.error).toContain("gateway tls: failed to load cert");

});

it("falls back to default paths when certPath and keyPath are empty strings", async () => {

const result = await loadGatewayTlsRuntime({

enabled: true,

certPath: "",

keyPath: "",

autoGenerate: false,

});

// Empty paths must not reach downstream — they must be replaced with defaults.

expect(result.certPath).toBeTruthy();

expect(result.certPath).not.toBe("");

expect(result.keyPath).toBeTruthy();

expect(result.keyPath).not.toBe("");

});

it("falls back to default paths when certPath and keyPath are whitespace-only", async () => {

const result = await loadGatewayTlsRuntime({

enabled: true,

certPath: " ",

keyPath: "\t",

autoGenerate: false,

});

expect(result.certPath).toBeTruthy();

expect(result.certPath).not.toBe(" ");

expect(result.keyPath).toBeTruthy();

expect(result.keyPath).not.toBe("\t");

});

it("does not fall back for non-empty paths with leading/trailing spaces", async () => {

const result = await loadGatewayTlsRuntime({

enabled: true,

certPath: " /etc/ssl/cert.pem ",

keyPath: " /etc/ssl/private/server.key ",

autoGenerate: false,

});

// Non-empty paths are passed through verbatim; resolveUserPath owns

// normalization (it trims), so they must not fall back to default names.

expect(result.certPath).not.toContain("gateway-cert.pem");

expect(result.keyPath).not.toContain("gateway-key.pem");

});

});

const autoGenerate = cfg.autoGenerate !== false;

const baseDir = path.join(CONFIG_DIR, "gateway", "tls");

const certPath = resolveUserPath(cfg.certPath ?? path.join(baseDir, "gateway-cert.pem"));

const keyPath = resolveUserPath(cfg.keyPath ?? path.join(baseDir, "gateway-key.pem"));

// Only blank/whitespace values fall back to the default. Any non-empty path is

// passed through verbatim so resolveUserPath owns all normalization (it trims

// and expands ~); trimming here would duplicate it and silently rewrite paths

// that contain leading/trailing spaces.

const certPath = resolveUserPath(

typeof cfg.certPath === "string" && cfg.certPath.trim()

? cfg.certPath

: path.join(baseDir, "gateway-cert.pem"),

);

const keyPath = resolveUserPath(

typeof cfg.keyPath === "string" && cfg.keyPath.trim()

? cfg.keyPath

: path.join(baseDir, "gateway-key.pem"),

);

const caPath = cfg.caPath ? resolveUserPath(cfg.caPath) : undefined;

const hasCert = await pathExists(certPath);