Desktop, Cli: Migrate from node-fetch to Undici (#16566)

packages/lib/utils/tls/setExtraRootCertificates.test.ts

@@ -0,0 +1,36 @@
+import { remove, writeFile } from 'fs-extra';
+import createLocalhostServer from '../../testing/createLocalhostServer';
+import { createTempDir, expectNotThrow, expectThrow } from '../../testing/test-utils';
+import { join } from 'path';
+import shim from '../../shim';
+import setExtraRootCertificates from './setExtraRootCertificates';
+
+describe('setExtraRootCertificates', () => {
+	it('should support loading extra root certificates from a directory', async () => {
+		await using httpsServer1 = await createLocalhostServer((_req, res) => {
+			res.writeHead(200);
+			res.end('test 1!');
+		}, { https: true });
+		await using httpsServer2 = await createLocalhostServer((_req, res) => {
+			res.writeHead(200);
+			res.end('test 2!');
+		}, { https: true });
+
+		const tempDir = await createTempDir();
+		try {
+			await expectThrow(async () => await shim.fetch(httpsServer1.baseUrl));
+			await expectThrow(async () => await shim.fetch(httpsServer2.baseUrl));
+
+			await writeFile(join(tempDir, 'cert-1.pem'), httpsServer1.cert, 'utf-8');
+			await writeFile(join(tempDir, 'cert-2.pem'), httpsServer2.cert, 'utf-8');
+
+			await setExtraRootCertificates([{ path: tempDir }]);
+
+			await expectNotThrow(async () => await shim.fetch(httpsServer2.baseUrl));
+			await expectNotThrow(async () => await shim.fetch(httpsServer1.baseUrl));
+		} finally {
+			await remove(tempDir);
+			await setExtraRootCertificates([]);
+		}
+	});
+});

packages/lib/utils/tls/setExtraRootCertificates.ts

@@ -0,0 +1,50 @@
+import { join } from 'node:path';
+import shim from '../../shim';
+import { getCACertificates, setDefaultCACertificates } from 'node:tls';
+
+let defaultCaCerts_: string[]|null = null;
+const defaultCaCerts = () => {
+	defaultCaCerts_ ??= getCACertificates();
+	return defaultCaCerts_;
+};
+
+type Cert = {
+	path: string; pem?: undefined;
+} | {
+	pem: string; path?: undefined;
+};
+
+let cacheKey = '[]';
+const setExtraRootCertificates = async (certs: Cert[]) => {
+	const newCacheKey = JSON.stringify(certs);
+	if (newCacheKey === cacheKey) return;
+
+	const cas = [...defaultCaCerts(), ...await readCertData(certs)];
+	setDefaultCACertificates(cas);
+	cacheKey = newCacheKey;
+};
+
+const readCertData = async (certs: Cert[]) => {
+	const certData: string[] = [];
+	for (const cert of certs) {
+		if (cert.pem) {
+			certData.push(cert.pem);
+		} else {
+			let filePaths;
+			if (await shim.fsDriver().isDirectory(cert.path)) {
+				filePaths = (await shim.fsDriver().readDirStats(cert.path))
+					.filter(stat => !stat.isDirectory())
+					.map(stat => join(cert.path, stat.path));
+			} else {
+				filePaths = [cert.path];
+			}
+
+			for (const filePath of filePaths) {
+				certData.push(await shim.fsDriver().readFile(filePath, 'utf-8'));
+			}
+		}
+	}
+	return certData;
+};
+
+export default setExtraRootCertificates;