@@ -856,4 +856,179 @@ describe('node-vault', () => {
856856 } ) ;
857857 } ) ;
858858 } ) ;
859+
860+ describe ( 'axios TLS options forwarding' , ( ) => {
861+ const https = require ( 'https' ) ;
862+ const axios = require ( 'axios' ) ;
863+ let axiosInstanceStub ;
864+ let axiosCreateStub ;
865+ let agentSpy ;
866+
867+ beforeEach ( ( ) => {
868+ // Stub axios.create to return a controllable instance stub
869+ axiosInstanceStub = sinon . stub ( ) . resolves ( {
870+ status : 200 ,
871+ data : { } ,
872+ } ) ;
873+ axiosCreateStub = sinon . stub ( axios , 'create' ) . returns ( axiosInstanceStub ) ;
874+ agentSpy = sinon . spy ( https , 'Agent' ) ;
875+ } ) ;
876+
877+ afterEach ( ( ) => {
878+ sinon . restore ( ) ;
879+ } ) ;
880+
881+ it ( 'should create default httpsAgent with ca option from config.requestOptions' , ( ) => {
882+ index ( {
883+ endpoint : 'http://localhost:8200' ,
884+ token : '123' ,
885+ requestOptions : {
886+ ca : 'my-custom-ca-cert' ,
887+ } ,
888+ } ) ;
889+ agentSpy . should . have . been . called ( ) ;
890+ const agentArgs = agentSpy . lastCall . args [ 0 ] ;
891+ expect ( agentArgs ) . to . have . property ( 'ca' , 'my-custom-ca-cert' ) ;
892+ expect ( axiosCreateStub . lastCall . args [ 0 ] ) . to . have . property ( 'httpsAgent' ) ;
893+ } ) ;
894+
895+ it ( 'should create default httpsAgent with cert and key from config.requestOptions' , ( ) => {
896+ index ( {
897+ endpoint : 'http://localhost:8200' ,
898+ token : '123' ,
899+ requestOptions : {
900+ cert : 'client-cert' ,
901+ key : 'client-key' ,
902+ passphrase : 'secret' ,
903+ } ,
904+ } ) ;
905+ agentSpy . should . have . been . called ( ) ;
906+ const agentArgs = agentSpy . lastCall . args [ 0 ] ;
907+ expect ( agentArgs ) . to . have . property ( 'cert' , 'client-cert' ) ;
908+ expect ( agentArgs ) . to . have . property ( 'key' , 'client-key' ) ;
909+ expect ( agentArgs ) . to . have . property ( 'passphrase' , 'secret' ) ;
910+ } ) ;
911+
912+ it ( 'should create default httpsAgent from agentOptions in config.requestOptions' , ( ) => {
913+ index ( {
914+ endpoint : 'http://localhost:8200' ,
915+ token : '123' ,
916+ requestOptions : {
917+ agentOptions : {
918+ securityOptions : 'SSL_OP_NO_SSLv3' ,
919+ cert : 'agent-cert' ,
920+ } ,
921+ } ,
922+ } ) ;
923+ agentSpy . should . have . been . called ( ) ;
924+ const agentArgs = agentSpy . lastCall . args [ 0 ] ;
925+ expect ( agentArgs ) . to . have . property ( 'securityOptions' , 'SSL_OP_NO_SSLv3' ) ;
926+ expect ( agentArgs ) . to . have . property ( 'cert' , 'agent-cert' ) ;
927+ } ) ;
928+
929+ it ( 'should allow per-call TLS options to override config.requestOptions' , ( ) => {
930+ const vault = index ( {
931+ endpoint : 'http://localhost:8200' ,
932+ token : '123' ,
933+ requestOptions : {
934+ ca : 'default-ca' ,
935+ } ,
936+ } ) ;
937+ return vault . read ( 'secret/hello' , { ca : 'override-ca' } ) . then ( ( ) => {
938+ // Per-call override creates a new per-request agent
939+ const axiosCallArg = axiosInstanceStub . firstCall . args [ 0 ] ;
940+ expect ( axiosCallArg ) . to . have . property ( 'httpsAgent' ) ;
941+ expect ( axiosCallArg . httpsAgent ) . to . be . an . instanceOf ( https . Agent ) ;
942+ // The last agent created should have the override value
943+ const agentArgs = agentSpy . lastCall . args [ 0 ] ;
944+ expect ( agentArgs ) . to . have . property ( 'ca' , 'override-ca' ) ;
945+ } ) ;
946+ } ) ;
947+
948+ it ( 'should not create per-request httpsAgent when no TLS options are present' , ( ) => {
949+ const vault = index ( {
950+ endpoint : 'http://localhost:8200' ,
951+ token : '123' ,
952+ } ) ;
953+ return vault . read ( 'secret/hello' ) . then ( ( ) => {
954+ const axiosCallArg = axiosInstanceStub . firstCall . args [ 0 ] ;
955+ expect ( axiosCallArg ) . to . not . have . property ( 'httpsAgent' ) ;
956+ } ) ;
957+ } ) ;
958+
959+ it ( 'should reuse default httpsAgent when config TLS options are unchanged' , ( ) => {
960+ const vault = index ( {
961+ endpoint : 'http://localhost:8200' ,
962+ token : '123' ,
963+ requestOptions : {
964+ ca : 'my-ca' ,
965+ } ,
966+ } ) ;
967+ const agentCountAfterInit = agentSpy . callCount ;
968+ return vault . read ( 'secret/hello' ) . then ( ( ) => {
969+ // No new agent should be created for request with same config options
970+ const axiosCallArg = axiosInstanceStub . firstCall . args [ 0 ] ;
971+ expect ( axiosCallArg ) . to . not . have . property ( 'httpsAgent' ) ;
972+ expect ( agentSpy . callCount ) . to . equal ( agentCountAfterInit ) ;
973+ } ) ;
974+ } ) ;
975+
976+ it ( 'should handle strictSSL: false in requestOptions' , ( ) => {
977+ index ( {
978+ endpoint : 'http://localhost:8200' ,
979+ token : '123' ,
980+ requestOptions : {
981+ strictSSL : false ,
982+ } ,
983+ } ) ;
984+ agentSpy . should . have . been . called ( ) ;
985+ const agentArgs = agentSpy . lastCall . args [ 0 ] ;
986+ expect ( agentArgs ) . to . have . property ( 'rejectUnauthorized' , false ) ;
987+ } ) ;
988+
989+ it ( 'should forward timeout from requestOptions to axios' , ( ) => {
990+ const vault = index ( {
991+ endpoint : 'http://localhost:8200' ,
992+ token : '123' ,
993+ requestOptions : {
994+ timeout : 5000 ,
995+ } ,
996+ } ) ;
997+ return vault . read ( 'secret/hello' ) . then ( ( ) => {
998+ const axiosCallArg = axiosInstanceStub . firstCall . args [ 0 ] ;
999+ expect ( axiosCallArg ) . to . have . property ( 'timeout' , 5000 ) ;
1000+ } ) ;
1001+ } ) ;
1002+
1003+ it ( 'should forward httpsAgent from requestOptions to axios' , ( ) => {
1004+ const customAgent = new https . Agent ( { keepAlive : true } ) ;
1005+ const vault = index ( {
1006+ endpoint : 'http://localhost:8200' ,
1007+ token : '123' ,
1008+ requestOptions : {
1009+ httpsAgent : customAgent ,
1010+ } ,
1011+ } ) ;
1012+ return vault . read ( 'secret/hello' ) . then ( ( ) => {
1013+ const axiosCallArg = axiosInstanceStub . firstCall . args [ 0 ] ;
1014+ expect ( axiosCallArg ) . to . have . property ( 'httpsAgent' , customAgent ) ;
1015+ } ) ;
1016+ } ) ;
1017+
1018+ it ( 'should forward httpAgent from requestOptions to axios' , ( ) => {
1019+ const http = require ( 'http' ) ;
1020+ const customAgent = new http . Agent ( ) ;
1021+ const vault = index ( {
1022+ endpoint : 'http://localhost:8200' ,
1023+ token : '123' ,
1024+ requestOptions : {
1025+ httpAgent : customAgent ,
1026+ } ,
1027+ } ) ;
1028+ return vault . read ( 'secret/hello' ) . then ( ( ) => {
1029+ const axiosCallArg = axiosInstanceStub . firstCall . args [ 0 ] ;
1030+ expect ( axiosCallArg ) . to . have . property ( 'httpAgent' , customAgent ) ;
1031+ } ) ;
1032+ } ) ;
1033+ } ) ;
8591034} ) ;
0 commit comments