|
| 1 | +// Copyright (c) 2026 Databricks, Inc. |
| 2 | +// |
| 3 | +// Licensed under the Apache License, Version 2.0 (the "License"); |
| 4 | +// you may not use this file except in compliance with the License. |
| 5 | +// You may obtain a copy of the License at |
| 6 | +// |
| 7 | +// http://www.apache.org/licenses/LICENSE-2.0 |
| 8 | +// |
| 9 | +// Unless required by applicable law or agreed to in writing, software |
| 10 | +// distributed under the License is distributed on an "AS IS" BASIS, |
| 11 | +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 12 | +// See the License for the specific language governing permissions and |
| 13 | +// limitations under the License. |
| 14 | + |
| 15 | +import { expect } from 'chai'; |
| 16 | +import { buildSeaConnectionOptions, buildSeaTlsOptions } from '../../../lib/sea/SeaAuth'; |
| 17 | +import { ConnectionOptions } from '../../../lib/contracts/IDBSQLClient'; |
| 18 | +import HiveDriverError from '../../../lib/errors/HiveDriverError'; |
| 19 | + |
| 20 | +const PEM = '-----BEGIN CERTIFICATE-----\nMIIBfakebase64\n-----END CERTIFICATE-----\n'; |
| 21 | + |
| 22 | +function patOpts(extra: Partial<ConnectionOptions> = {}): ConnectionOptions { |
| 23 | + return { |
| 24 | + host: 'example.cloud.databricks.com', |
| 25 | + path: '/sql/1.0/warehouses/abc', |
| 26 | + token: 'dapi-fake-pat', |
| 27 | + ...extra, |
| 28 | + } as ConnectionOptions; |
| 29 | +} |
| 30 | + |
| 31 | +describe('SeaAuth — TLS options', () => { |
| 32 | + describe('buildSeaTlsOptions', () => { |
| 33 | + it('returns an empty object when no TLS options are set (thrift-compatible default)', () => { |
| 34 | + expect(buildSeaTlsOptions(patOpts())).to.deep.equal({}); |
| 35 | + }); |
| 36 | + |
| 37 | + it('passes checkServerCertificate: true through', () => { |
| 38 | + expect(buildSeaTlsOptions(patOpts({ checkServerCertificate: true }))).to.deep.equal({ |
| 39 | + checkServerCertificate: true, |
| 40 | + }); |
| 41 | + }); |
| 42 | + |
| 43 | + it('passes checkServerCertificate: false through explicitly', () => { |
| 44 | + expect(buildSeaTlsOptions(patOpts({ checkServerCertificate: false }))).to.deep.equal({ |
| 45 | + checkServerCertificate: false, |
| 46 | + }); |
| 47 | + }); |
| 48 | + |
| 49 | + it('converts a PEM string customCaCert to a Buffer', () => { |
| 50 | + const tls = buildSeaTlsOptions(patOpts({ customCaCert: PEM })); |
| 51 | + expect(Buffer.isBuffer(tls.customCaCert)).to.equal(true); |
| 52 | + expect(tls.customCaCert!.toString('utf8')).to.equal(PEM); |
| 53 | + }); |
| 54 | + |
| 55 | + it('passes a Buffer customCaCert through unchanged', () => { |
| 56 | + const buf = Buffer.from(PEM, 'utf8'); |
| 57 | + const tls = buildSeaTlsOptions(patOpts({ customCaCert: buf })); |
| 58 | + expect(tls.customCaCert).to.equal(buf); |
| 59 | + }); |
| 60 | + |
| 61 | + it('honours customCaCert regardless of checkServerCertificate', () => { |
| 62 | + const tls = buildSeaTlsOptions(patOpts({ checkServerCertificate: true, customCaCert: PEM })); |
| 63 | + expect(tls.checkServerCertificate).to.equal(true); |
| 64 | + expect(Buffer.isBuffer(tls.customCaCert)).to.equal(true); |
| 65 | + }); |
| 66 | + |
| 67 | + it('throws on a customCaCert string without a PEM header', () => { |
| 68 | + expect(() => buildSeaTlsOptions(patOpts({ customCaCert: 'not-a-pem' }))).to.throw( |
| 69 | + HiveDriverError, |
| 70 | + /does not look like a PEM certificate/, |
| 71 | + ); |
| 72 | + }); |
| 73 | + |
| 74 | + it('throws on an empty customCaCert Buffer', () => { |
| 75 | + expect(() => buildSeaTlsOptions(patOpts({ customCaCert: Buffer.alloc(0) }))).to.throw(HiveDriverError, /empty/); |
| 76 | + }); |
| 77 | + }); |
| 78 | + |
| 79 | + describe('buildSeaConnectionOptions integration', () => { |
| 80 | + it('omits TLS keys entirely when not supplied', () => { |
| 81 | + const native = buildSeaConnectionOptions(patOpts()); |
| 82 | + expect(native).to.not.have.property('checkServerCertificate'); |
| 83 | + expect(native).to.not.have.property('customCaCert'); |
| 84 | + }); |
| 85 | + |
| 86 | + it('threads TLS options onto the napi shape alongside auth', () => { |
| 87 | + const native = buildSeaConnectionOptions(patOpts({ checkServerCertificate: true, customCaCert: PEM })); |
| 88 | + expect(native.authMode).to.equal('Pat'); |
| 89 | + expect(native.checkServerCertificate).to.equal(true); |
| 90 | + expect(native.customCaCert!.toString('utf8')).to.equal(PEM); |
| 91 | + }); |
| 92 | + |
| 93 | + it('propagates customCaCert validation errors', () => { |
| 94 | + expect(() => buildSeaConnectionOptions(patOpts({ customCaCert: 'garbage' }))).to.throw(HiveDriverError); |
| 95 | + }); |
| 96 | + }); |
| 97 | +}); |
0 commit comments