feat(csi-47): added negative test scenarios for int tests

.github/workflows/main.yml

@@ -52,6 +52,6 @@ jobs:
         run: |
           docker compose build
           docker compose up -d
-          sleep 15
+          echo "waiting for 10sec before tests run..." && sleep 10
           npm run test:int
           docker compose down -v  

docker-compose.yml

@@ -27,7 +27,7 @@ services:
     build:
       context: ./
       dockerfile: Dockerfile
-    command: /bin/sh -c "sleep 15 && npm start" # todo: use better approach instead of sleep 15
+    command: /bin/sh -c "sleep 10 && npm start" # todo: use better approach instead of sleep 10
     restart: on-failure
     env_file: .env
     environment:

test/certs.json

@@ -0,0 +1,7 @@
+{
+  "wrongClient": {
+    "ca": "-----BEGIN CERTIFICATE-----\nMIIDazCCAlOgAwIBAgIUfKD8ZlWxBAAax4e/OitK+WBMIswwDQYJKoZIhvcNAQEL\nBQAwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgMClNvbWUtU3RhdGUxITAfBgNVBAoM\nGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDAeFw0yNDA2MTgxMTQ0MTRaFw0yNzA0\nMDgxMTQ0MTRaMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIDApTb21lLVN0YXRlMSEw\nHwYDVQQKDBhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwggEiMA0GCSqGSIb3DQEB\nAQUAA4IBDwAwggEKAoIBAQDubQRiN3XoPx1hOofH6XfOCeTq5c7DEKL8+pECF9tV\nAIP1hw/zVizvPHMT4RYWkD8kTHHr6Crv8SxvE1jv2byM9hBe/GC0BrAL1By1fhar\nnmjp0DqNBA3G7D8U1DrQn03h130t1A0lMeKDWd6z1Vjtj44d1o/VX9YXcOt4zUuG\ng8ExS01almhuC7i4MyRBj7dEQbo1zKMyG9U9RyvAgEXxLYj6wqICYm0RF3OTFpHJ\nwMsPv5gGnB1CaSJPqZ01KZ0zqxL6C9mFIQ/JuHmNMSSJhbGILA9K3LyWsAOne+vS\n7WZ0PmuhyNREhLQixkGd5424CczkaL52sYDk4BNXbz4ZAgMBAAGjUzBRMB0GA1Ud\nDgQWBBSztAzmnRG4quhJYEeMlJbkhH8erjAfBgNVHSMEGDAWgBSztAzmnRG4quhJ\nYEeMlJbkhH8erjAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQCi\n4IN73//vHpoJGobylD6SJlnYogl009hBvM83hs0qsBjGM/3+N/yIkSYdLh8SHV5H\n5deBZn7IVyrUb021WqwBTwuxSL+/LRV7y/7DfWtyvspQk6zw76V/5bc42jemcQbz\n9IgmlvaueQMgic+HLUHJExu2nsQ462DtbEYhMHUtkVhydSQa8oD0Yd1cJ62kbch7\nZqHpkGQCSkRrn4mwDaamvy8FSpgoEhVbSO7qZdKjI+3wOOBKysrm4PoWDEBtsKnK\nlco+8FJ8MZ4s+6x1dFpPz/gSWZVQuP4AnUSZQvrdagePyCNk/4fAKhKC17bboAJO\nfTRV0M7d3bttWN+jnuI7\n-----END CERTIFICATE-----",
+    "cert": "-----BEGIN CERTIFICATE-----\nMIIDETCCAfkCFH53hS/m3ttkMEBhKIs28TOaxgz4MA0GCSqGSIb3DQEBCwUAMEUx\nCzAJBgNVBAYTAkFVMRMwEQYDVQQIDApTb21lLVN0YXRlMSEwHwYDVQQKDBhJbnRl\ncm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMjQwNjE4MTE0NDU0WhcNMjUxMDMxMTE0\nNDU0WjBFMQswCQYDVQQGEwJBVTETMBEGA1UECAwKU29tZS1TdGF0ZTEhMB8GA1UE\nCgwYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIIBIjANBgkqhkiG9w0BAQEFAAOC\nAQ8AMIIBCgKCAQEAw/OUOCklKUiMndM6ZbBAetnJ9kePWgi6o9K5hxaDvSmrZsUk\nuyZ26Y4EvIZUzi/NFZU9gslheuatLmLTfUhTJgtsKd1kAV9oqdgSPMRVTTkkELUb\nYYXryvipGxDmmffsvzTg+aD5V3AGhGZIX8r7G1b2eBv8hc6SZIvLUWXfL7hOtFlE\nAypsEGSqERfOT0NVION/hYyLiPUTHJy0yqt5C8+tU+ghiEqNY2CEKyWGsm0hp+jX\nMdydn3jKL9MzH0eM4v9oyF+KyFvjxDNoZL7rGHg1n3lVhgVaqFw4PllRE1tKkq8H\nE4cRrLBURIGArf1psx5X4RT2U2J3l/w5WQlTkwIDAQABMA0GCSqGSIb3DQEBCwUA\nA4IBAQDF/N+aORu+Z3pWnpnm1O0Vv9lzMM0TfWwq4H48kFzUMb4hyIatw5JbXaMH\n5fpIYG5vcxarT7rRvud78nT3udRWa1UZ+bPnAcENvZvezF1JmvuEe06FV1Vszfkn\nC6bDl8Nz5xXjiz9Ox+n10vW7hnkrYhCNRn8GN4A4jAXYx97n9BlCrfdiI214fF5x\nGJ2RSA2KRET17Kpu3eg9E3ZNMUHOuh9qDmlAUcARipZdsaqJF7eCwGqpFF67qx2S\n9gN96zXq2OJ/o1nDRowP3W0MAf7hfsaA15nfRN2FROBTz5pxOGUnmYvDYBuyQEkY\nM13+Glzs8cLJjPIGL9zEt2aLBsNa\n-----END CERTIFICATE-----",
+    "key": "-----BEGIN PRIVATE KEY-----\nMIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDD85Q4KSUpSIyd\n0zplsEB62cn2R49aCLqj0rmHFoO9KatmxSS7JnbpjgS8hlTOL80VlT2CyWF65q0u\nYtN9SFMmC2wp3WQBX2ip2BI8xFVNOSQQtRthhevK+KkbEOaZ9+y/NOD5oPlXcAaE\nZkhfyvsbVvZ4G/yFzpJki8tRZd8vuE60WUQDKmwQZKoRF85PQ1Ug43+FjIuI9RMc\nnLTKq3kLz61T6CGISo1jYIQrJYaybSGn6Ncx3J2feMov0zMfR4zi/2jIX4rIW+PE\nM2hkvusYeDWfeVWGBVqoXDg+WVETW0qSrwcThxGssFREgYCt/WmzHlfhFPZTYneX\n/DlZCVOTAgMBAAECggEBALCmAMPUS9z4u1N4XdfYWXimp8wu3MuUvPT8/iYLJP49\n93fxV9ijp2WLkzeFfiRWsXK4lLg35XoPRKZhjzkNH3BXsc3X+NTH9ynOUTqY4DF6\nxsmNCz8SpOvY2VI+HTVGbRY+jGZeOQobQrTPJIW/DjqqXg0PZcoW3KBp6gPaa6au\n0PiJCl6djxR0r2G2Qo4QWJKMEynqtu9OMBlQMZEG73rb0FzCcvtLGEfvVg6EaZAz\niFh7B2BU2DMTYa4xsx51C7O1lsK4ntv3e0NuSFUBfklW0INUNHZAVP+/SwWa8XJf\nfBBdjudlxiyWfTEqGVWkn6m2WuVtrTGolualwJ1HQvECgYEA/LI6kWoprSpwjjLq\n4mwKmjnrjbCcEE5+P23CgN2YYFniuYnBhbjuegBk5jzISd+0KA2s0mEBjqg7Jaco\nMv5c3Hz0214S8RgxO83/4toWHsDRgJZuPopKgM1t5WkdUt0Y5zIiAAaNsIbOTOA4\nUyBlotK0luXaAjoJU38PIBcGhMsCgYEAxoNtIEA8ly59U/3wK8+6SzFWgpKP6WMT\nwS/9DuvG3zJRA5yFPAv2Dmhp8Lo0l+e6i6fwLsMrx9SpIQcx/HUzxPJommvxsfI+\nca6jik+hljcAWGT5ZQK4T42VxBlRyJtLATRJR4WnpbZcWfRy8AQ21j6S/jZgyFRf\nrVhfOJKTW1kCgYAu+pOY5TvKTdGPHjg80AlIkuwP832QKoeeEzHN82SYxR05kTrB\nOZhcZiZcB4DU+xnrOF+g3RgFBZG5dlIq6M8qzrBW+C5dVDoS/EFOU205Wm+YkF7+\nkYc4WvjLZbdl6GTw1okrqAw/fVBtSmIuUh+THcklJKZbM574Pu748E7t8QKBgQC3\n6p+514nLT2kR3h0bmhMxAv7xbjQiuIZe38UGg+72brmcLPFLlpFa++Xa/8kmS60L\nIoZl7LCtLRuc2/u1uChEeYnsN8HvaU3tKS2fQPOmJkMNok9lBEYafkSZMBQTVb0B\n2p1hxDR0VSXuuYmbUWw0xjiNiXfVYkZaZZui4Dnh0QKBgDJkG2QvK2w5/yOJW6S3\nc9TB0XHzC14aWmbeYWUwAbzAyfeuOhSz+7TxqrzWn54icpHS4ubhyLsVZOLIeIOK\nwBbUFWMz7Fl7bpCiLja4wp4PGfXxEXWUY76DUDgy1dtTHpmaR5r7zIMZR8Sf1CTe\nXBsI2HW3VX0swibHS36xcvDh\n-----END PRIVATE KEY-----"
+  }
+}

test/integration/domain/ISPA.test.ts

@@ -23,12 +23,15 @@
  --------------
  **********/
 
+import https from 'node:https';
 import axios from 'axios'; // todo: add wrapper
 import config from '#src/config';
 import { PROXY_HEADER, AUTH_HEADER } from '#src/constants';
 
+import certs from '#test/certs.json';
+
 const PROXY_HOST = 'http://localhost';
-const { serverAConfig, PROXY_ID } = config.get();
+const { serverAConfig, hubAConfig, PROXY_ID } = config.get();
 
 const checkProxyServiceHeaders = (headers: Record<string, unknown>) => {
   expect(headers[PROXY_HEADER.toLowerCase()]).toBe(PROXY_ID);
@@ -56,5 +59,33 @@ describe('ISPA Integration Tests -->', () => {
     expect(data.body).toEqual(payload);
     expect(data.headers.h1).toBe(headers.h1);
   });
-  // todo: add negative scenario with wrong certs and auth token
+
+  describe('mTLS hub (peer-endpoint) Tests -->', () => {
+    const url = `${hubAConfig.baseUrl}/int-test`;
+    const sendGetRequest = async (options: axios.AxiosRequestConfig) =>
+      axios
+        .request({
+          ...options,
+          method: 'GET',
+        })
+        .catch((err) => err);
+
+    test('should fail when connect to https hub (peer-endpoint) without certs', async () => {
+      const httpsAgent = new https.Agent({ rejectUnauthorized: false });
+      const response = await sendGetRequest({ url, httpsAgent });
+      expect(response).toBeInstanceOf(Error);
+      expect(response.message).toMatch(/routines:ssl3_read_bytes:tlsv13 alert certificate required/);
+    });
+
+    test('should fail when connect to https hub (peer-endpoint) with wrong certs', async () => {
+      const httpsAgent = new https.Agent({
+        ...certs.wrongClient,
+        rejectUnauthorized: false,
+      });
+      const response = await sendGetRequest({ url, httpsAgent });
+      expect(response).toBeInstanceOf(Error);
+      expect(response.message).toBe('socket hang up');
+    });
+  });
+  // todo: add negative scenario with wrong auth token
 });