perf: 【破坏性更新】证书压缩包不再生成文件存储，而是实时打包下载，证书申请插件不再输出certZip

自定义插件需要压缩包时可以调用new CertReader(certInfo).buildZip() 方式获取
2026-07-01 17:07:32 +08:00 · 2026-06-30 23:41:59 +08:00
parent cfba7b4daa
commit 7cff1a9842
18 changed files with 289 additions and 198 deletions
@@ -0,0 +1,109 @@
+/// <reference types="mocha" />
+/// <reference types="node" />
+
+import assert from "node:assert/strict";
+
+import { CertReader } from "../src/cert/cert-reader.js";
+import type { CertInfo } from "../src/cert/cert-reader.js";
+
+// @ts-ignore
+import forge from "node-forge";
+
+/**
+ * Generate a minimal self-signed X.509 cert + key in PEM format for testing.
+ */
+function createSelfSignedCert(commonName: string): { crt: string; key: string } {
+  const keypair = forge.pki.rsa.generateKeyPair(2048);
+
+  const cert = forge.pki.createCertificate();
+  cert.publicKey = keypair.publicKey;
+  cert.serialNumber = "01";
+  cert.validFrom = new Date("2025-01-01").toISOString();
+  cert.validTo = new Date("2026-01-01").toISOString();
+
+  const attrs = [{ name: "commonName", value: commonName }];
+  cert.setSubject(attrs);
+  cert.setIssuer(attrs);
+  cert.sign(keypair.privateKey, forge.md.sha256.create());
+
+  return {
+    crt: forge.pki.certificateToPem(cert),
+    key: forge.pki.privateKeyToPem(keypair.privateKey),
+  };
+}
+
+const testCert = createSelfSignedCert("example.com");
+const testCertIc = createSelfSignedCert("intermediate.ca");
+const mockCertInfo: CertInfo = {
+  crt: testCert.crt + "\n" + testCertIc.crt,
+  key: testCert.key,
+  oc: testCert.crt,
+  ic: testCertIc.crt,
+  one: testCert.crt + "\n" + testCert.key,
+  p7b: "PKCS7 test content",
+  pfx: Buffer.from("fake-pfx-data").toString("base64"),
+  der: Buffer.from("fake-der-data").toString("base64"),
+  jks: Buffer.from("fake-jks-data").toString("base64"),
+};
+
+describe("CertReader.buildZip", () => {
+  it("returns a non-empty Buffer", async () => {
+    const reader = new CertReader(mockCertInfo);
+    const buf = await reader.buildZip();
+    assert.ok(Buffer.isBuffer(buf));
+    assert.ok(buf.length > 0);
+  });
+
+  it("produces a valid zip containing expected files", async () => {
+    const reader = new CertReader(mockCertInfo);
+    const buf = await reader.buildZip();
+    const { default: JSZip } = await import("jszip");
+    const zip = await JSZip.loadAsync(buf);
+
+    assert.ok(zip.file("证书.pem"), "should contain 证书.pem");
+    assert.ok(zip.file("私钥.pem"), "should contain 私钥.pem");
+    assert.ok(zip.file("中间证书.pem"), "should contain 中间证书.pem");
+    assert.ok(zip.file("cert.crt"), "should contain cert.crt");
+    assert.ok(zip.file("cert.key"), "should contain cert.key");
+    assert.ok(zip.file("intermediate.crt"), "should contain intermediate.crt");
+    assert.ok(zip.file("origin.crt"), "should contain origin.crt");
+    assert.ok(zip.file("one.pem"), "should contain one.pem");
+    assert.ok(zip.file("cert.p7b"), "should contain cert.p7b");
+    assert.ok(zip.file("cert.pfx"), "should contain cert.pfx");
+    assert.ok(zip.file("cert.der"), "should contain cert.der");
+    assert.ok(zip.file("cert.jks"), "should contain cert.jks");
+    assert.ok(zip.file("说明.txt"), "should contain 说明.txt");
+
+    const pemContent = await zip.file("证书.pem").async("string");
+    assert.ok(pemContent.includes("-----BEGIN CERTIFICATE-----"));
+
+    const pfx = await zip.file("cert.pfx").async("nodebuffer");
+    assert.equal(pfx.toString(), "fake-pfx-data");
+  });
+});
+
+describe("CertReader.buildZipFilename", () => {
+  it("includes the main domain and timestamp", () => {
+    const reader = new CertReader(mockCertInfo);
+    const name = reader.buildZipFilename("cert");
+    assert.ok(name.startsWith("cert_example_com_"));
+    assert.ok(name.endsWith(".zip"));
+    const tsPart = name.replace("cert_example_com_", "").replace(".zip", "");
+    assert.match(tsPart, /^\d{14}$/);
+  });
+
+  it("uses the default prefix when not provided", () => {
+    const reader = new CertReader(mockCertInfo);
+    const name = reader.buildZipFilename();
+    assert.ok(name.startsWith("cert_example_com_"));
+  });
+
+  it("wildcard domain replaces asterisk", () => {
+    const wildcardCert = createSelfSignedCert("*.example.com");
+    const wcInfo: CertInfo = { crt: wildcardCert.crt, key: wildcardCert.key };
+    const reader = new CertReader(wcInfo);
+    const name = reader.buildZipFilename("cert");
+    assert.ok(name.startsWith("cert___example_com_"), "asterisk should be replaced, got: " + name);
+    assert.ok(!name.includes("*"));
+  });
+});