@andrewheberle/serverless-ssh-ca-testing
Runs the Serverless SSH CA for end-to-end tests of clients, such as ssh-ca-client.
The CA can be run under:
node: Node.js, using the package's Node.js helpers with an in-memorynode:sqlitedatabaseworkerd: the Cloudflare Workers runtime, using the Wrangler test harness with a local D1 database and Secrets Store, aswrangler devwould
Nothing is persisted between runs.
This package is released with @andrewheberle/serverless-ssh-ca and uses
whichever version of that package is installed alongside it. To test a client
against an unreleased version of the CA, install a tarball from npm pack in
its place.
Requirements
Node.js 24 or later.
Usage
npm install --save-dev @andrewheberle/serverless-ssh-ca @andrewheberle/serverless-ssh-ca-testing
npx serverless-ssh-ca-test-server [--runtime node|workerd] config.json
The runtime defaults to node. Clients that start the server from another
language can run node node_modules/@andrewheberle/serverless-ssh-ca-testing/dist/cli.js,
which avoids the platform-specific shims in node_modules/.bin.
The server exits when its standard input is closed, so it does not outlive the test that started it. If it cannot start, it writes the reason to standard error and exits with status 1.
Configuration
The configuration file is a JSON object:
| Property | Description |
|---|---|
private_key | The CA private key in OpenSSH format |
bindings | The CA configuration, as the Workers vars (environment variables) |
port_file | Path the port is written to once the CA is listening on 127.0.0.1 |
log_file | Path that log output from the CA and harness is appended to as JSON lines |
The bindings are those documented for the CA, with every value as a string.
Under workerd, Wrangler's working files are written to the directory
containing the configuration file.
Log file
Each line of the log file is a JSON object with at least level and
message. Lines logged by the CA are written as they are, and the harness adds
lines whose message starts with harness:
{"level":"info","message":"harness request","method":...,"url":...,"status":...}for every request, whereurlis the path and query. Whenstatusis 400 or more,bodyholds the response body, so a test can check why a request was rejected.{"level":"error","message":"harness ...",...}for a fault, meaning the CA or harness failed rather than rejected a request. Some faults, such as a failure to record an issued certificate, are only visible in the log, so tests should fail if any of these lines appear. A CA log line that indicates a fault is followed by a line with the messageharness faultand the original line inline.
Under workerd, the CA's output is copied to the log file every 100ms, so a
request may be logged shortly after its response is received.
Programmatic use
import { startTestServer } from "@andrewheberle/serverless-ssh-ca-testing"
const server = await startTestServer("node", "config.json")
// make requests to http://127.0.0.1:${server.port}
await server.close()
Under node the CA's console output is redirected to the log file until the
server is closed.