test: generate TLS certs at runtime so CI does not depend on ignored examples/*.pem

- Add node-forge dev dependency and test/fixtures/tls-certs.ts helper

- Refactor tls-manager.test.ts and tls-integration.test.ts to use generated certs

- Fixes CI failures where examples/cert.pem and examples/key.pem are gitignored

Author: jkyberneees

bun.lock

@@ -28,6 +28,7 @@
   },
   "devDependencies": {
     "@types/bun": "^1.2.0",
+    "node-forge": "^1.4.0",
     "prettier": "^3.6.2"
   },
   "main": "lib/index.js",

package.json

@@ -0,0 +1,72 @@
+/**
+ * Runtime TLS certificate generation for tests.
+ *
+ * Avoids committing private keys to the repository while keeping TLS tests
+ * self-contained and runnable in CI without external tools.
+ */
+
+import * as forge from 'node-forge'
+import { mkdirSync, writeFileSync, existsSync } from 'fs'
+import { tmpdir } from 'os'
+import { join } from 'path'
+
+export interface TestTLSCert {
+  cert: string
+  key: string
+  certPath: string
+  keyPath: string
+}
+
+let cached: TestTLSCert | null = null
+
+/**
+ * Generates (or returns a cached) self-signed certificate/key pair.
+ */
+export function generateTestTLSCert(): TestTLSCert {
+  if (cached) return cached
+
+  const keys = forge.pki.rsa.generateKeyPair(2048)
+  const cert = forge.pki.createCertificate()
+  cert.publicKey = keys.publicKey
+  cert.serialNumber = '01'
+  cert.validity.notBefore = new Date()
+  cert.validity.notAfter = new Date()
+  cert.validity.notAfter.setFullYear(cert.validity.notBefore.getFullYear() + 1)
+
+  const attrs = [
+    { name: 'commonName', value: 'localhost' },
+    { name: 'countryName', value: 'US' },
+    { shortName: 'ST', value: 'Test' },
+    { name: 'localityName', value: 'Test' },
+    { name: 'organizationName', value: 'Bungate Tests' },
+  ]
+  cert.setSubject(attrs)
+  cert.setIssuer(attrs)
+  cert.setExtensions([
+    {
+      name: 'subjectAltName',
+      altNames: [
+        { type: 2, value: 'localhost' },
+        { type: 7, ip: '127.0.0.1' },
+      ],
+    },
+  ])
+
+  cert.sign(keys.privateKey, forge.md.sha256.create())
+
+  const certPem = forge.pki.certificateToPem(cert)
+  const keyPem = forge.pki.privateKeyToPem(keys.privateKey)
+
+  const dir = join(tmpdir(), 'bungate-test-certs')
+  if (!existsSync(dir)) {
+    mkdirSync(dir, { recursive: true })
+  }
+  const certPath = join(dir, 'cert.pem')
+  const keyPath = join(dir, 'key.pem')
+
+  writeFileSync(certPath, certPem)
+  writeFileSync(keyPath, keyPem)
+
+  cached = { cert: certPem, key: keyPem, certPath, keyPath }
+  return cached
+}

test/fixtures/tls-certs.ts

@@ -2,6 +2,9 @@ import { describe, test, expect, afterEach } from 'bun:test'
 import { BunGateway } from '../../src/gateway/gateway'
 import { BunGateLogger } from '../../src/logger/pino-logger'
 import type { Server } from 'bun'
+import { generateTestTLSCert } from '../fixtures/tls-certs'
+
+const testCert = generateTestTLSCert()
 
 describe('TLS Integration with Gateway', () => {
   let gateways: BunGateway[] = []
@@ -45,8 +48,8 @@ describe('TLS Integration with Gateway', () => {
       security: {
         tls: {
           enabled: true,
-          cert: './examples/cert.pem',
-          key: './examples/key.pem',
+          cert: testCert.certPath,
+          key: testCert.keyPath,
           minVersion: 'TLSv1.2',
         },
       },
@@ -87,8 +90,8 @@ describe('TLS Integration with Gateway', () => {
       security: {
         tls: {
           enabled: true,
-          cert: './examples/cert.pem',
-          key: './examples/key.pem',
+          cert: testCert.certPath,
+          key: testCert.keyPath,
           redirectHTTP: true,
           redirectPort: httpPort,
         },
@@ -176,8 +179,8 @@ describe('TLS Integration with Gateway', () => {
       security: {
         tls: {
           enabled: true,
-          cert: readFileSync('./examples/cert.pem'),
-          key: readFileSync('./examples/key.pem'),
+          cert: readFileSync(testCert.certPath),
+          key: readFileSync(testCert.keyPath),
         },
       },
       routes: [
@@ -202,8 +205,8 @@ describe('TLS Integration with Gateway', () => {
       security: {
         tls: {
           enabled: true,
-          cert: './examples/cert.pem',
-          key: './examples/key.pem',
+          cert: testCert.certPath,
+          key: testCert.keyPath,
           minVersion: 'TLSv1.3',
         },
       },

test/security/tls-integration.test.ts

@@ -6,12 +6,15 @@ import {
 } from '../../src/security/tls-manager'
 import type { TLSConfig } from '../../src/security/config'
 import { readFileSync } from 'fs'
+import { generateTestTLSCert } from '../fixtures/tls-certs'
+
+const testCert = generateTestTLSCert()
 
 describe('TLSManager', () => {
   const validConfig: TLSConfig = {
     enabled: true,
-    cert: './examples/cert.pem',
-    key: './examples/key.pem',
+    cert: testCert.certPath,
+    key: testCert.keyPath,
     minVersion: 'TLSv1.2',
   }
 
@@ -153,8 +156,8 @@ describe('TLSManager', () => {
     })
 
     test('should accept certificate as Buffer', async () => {
-      const certBuffer = readFileSync('./examples/cert.pem')
-      const keyBuffer = readFileSync('./examples/key.pem')
+      const certBuffer = readFileSync(testCert.certPath)
+      const keyBuffer = readFileSync(testCert.keyPath)
       const config: TLSConfig = {
         enabled: true,
         cert: certBuffer,
@@ -171,7 +174,7 @@ describe('TLSManager', () => {
       const config: TLSConfig = {
         enabled: true,
         cert: './nonexistent-cert.pem',
-        key: './examples/key.pem',
+        key: testCert.keyPath,
       }
       const manager = new TLSManager(config)
       await expect(manager.loadCertificates()).rejects.toThrow(
@@ -182,7 +185,7 @@ describe('TLSManager', () => {
     test('should throw error for invalid key path', async () => {
       const config: TLSConfig = {
         enabled: true,
-        cert: './examples/cert.pem',
+        cert: testCert.certPath,
         key: './nonexistent-key.pem',
       }
       const manager = new TLSManager(config)
@@ -201,9 +204,9 @@ describe('TLSManager', () => {
     test('should load CA certificate when provided', async () => {
       const config: TLSConfig = {
         enabled: true,
-        cert: './examples/cert.pem',
-        key: './examples/key.pem',
-        ca: './examples/cert.pem', // Using cert as CA for testing
+        cert: testCert.certPath,
+        key: testCert.keyPath,
+        ca: testCert.certPath, // Using cert as CA for testing
       }
       const manager = new TLSManager(config)
       await manager.loadCertificates()