Generate the TLS test certificate instead of committing it

A committed private key, even one scoped to localhost with no security
value, is flagged by every secret scanner forever, and the false positive
has to be re-triaged on each new scan. SonarQube, CodeQL and GitHub secret
scanning would all report it.

fake-server now generates the pair on first use and caches it under
test/fixtures/, which is gitignored. Cold generation costs about 150 ms
once; every later run is exactly as fast as reading a committed fixture,
so the local speed advantage is preserved.

Without openssl on PATH the TLS suite skips rather than fails, so a
contributor lacking it still gets a green run — at the cost of not
covering the HTTPS login path.

Also adds a CodeQL workflow. It cannot run while the repository is private
(that needs Advanced Security) but will start on the first push after it
goes public.

Note the historical blob remains reachable in earlier commits; removing it
entirely would need another history rewrite.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: mschmicking

.github/workflows/codeql.yml

@@ -0,0 +1,33 @@
+name: CodeQL
+
+# GitHub's own static analysis. Free on public repositories; on a private repo it
+# requires GitHub Advanced Security, so this will simply not run until the
+# repository is public.
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    # Rules are updated continuously, so a weekly run finds things that did not
+    # exist as findings when the code was written.
+    - cron: '0 7 * * 1'
+
+jobs:
+  analyze:
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      contents: read
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: github/codeql-action/init@v3
+        with:
+          languages: javascript-typescript
+          # security-extended adds lower-severity rules; worth it for a tool that
+          # handles credentials and writes files from server-controlled ids.
+          queries: security-extended
+
+      - uses: github/codeql-action/analyze@v3

.gitignore

@@ -12,3 +12,6 @@ dist-test/
 .iobroker/
 
 *.log
+
+# TLS test certificate, generated on first test run (never committed)
+test/fixtures/*.pem

test/auth-tls.test.ts

@@ -16,14 +16,16 @@ import { after, afterEach, before, beforeEach, describe, it } from 'node:test';
 import assert from 'node:assert/strict';
 import * as path from 'node:path';
 
-import { FakeAdminServer } from './fake-server';
+import { FakeAdminServer, tlsFixtureAvailable } from './fake-server';
 import { getAuthCookie } from '../src/client/auth';
 import { UserError } from '../src/types';
 import { TempProject, makeTempProject } from './helpers';
 
 const NO_PROMPT = { allowPrompt: false } as const;
 
-describe('getAuthCookie over https with a self-signed certificate', () => {
+// openssl generates the certificate on first run; without it these are skipped
+// rather than failing, so a contributor without openssl still gets a green suite.
+describe('getAuthCookie over https with a self-signed certificate', { skip: tlsFixtureAvailable() ? false : 'openssl not available' }, () => {
   let server: FakeAdminServer;
   let url: string;
   let project: TempProject;

test/fake-server.ts

@@ -8,6 +8,7 @@
  * `[3, id, command, args]` and are answered with `[3, id, null, [err, result]]`.
  */
 
+import { execFileSync } from 'node:child_process';
 import * as fs from 'node:fs';
 import * as http from 'node:http';
 import * as https from 'node:https';
@@ -16,24 +17,68 @@ import WebSocket from 'ws';
 import { IoBrokerObject } from '../src/types';
 
 /**
- * Self-signed certificate for the TLS mode, generated with a 20-year lifetime and
- * committed under `test/fixtures/`. An ioBroker instance with authentication enabled
- * is normally also on HTTPS with exactly this kind of certificate, so the
- * `allowSelfSigned` path needs a real TLS handshake to be tested at all.
+ * Self-signed certificate for the TLS mode.
  *
- * Resolved against the source tree because the compiled tests live in `dist-test/`
- * and the `.pem` files are not copied there.
+ * An ioBroker instance with authentication enabled is normally also on HTTPS with
+ * exactly this kind of certificate, so the `allowSelfSigned` path needs a real TLS
+ * handshake to be tested at all.
+ *
+ * The pair is **generated on first use and cached** in `test/fixtures/`, not committed.
+ * Committing a private key — even a worthless one for localhost — means every future
+ * secret scanner flags the repository forever. Generating it per run would be slower,
+ * so it is written once and reused; the files are gitignored.
+ *
+ * Resolved against the source tree because the compiled tests live in `dist-test/`.
  */
-function fixturePath(name: string): string {
-  const candidates = [
-    path.resolve(process.cwd(), 'test', 'fixtures', name),
-    path.resolve(__dirname, 'fixtures', name),
-    path.resolve(__dirname, '..', '..', 'test', 'fixtures', name),
-  ];
-  for (const candidate of candidates) {
+function fixturesDir(): string {
+  for (const candidate of [
+    path.resolve(process.cwd(), 'test', 'fixtures'),
+    path.resolve(__dirname, 'fixtures'),
+    path.resolve(__dirname, '..', '..', 'test', 'fixtures'),
+  ]) {
     if (fs.existsSync(candidate)) return candidate;
   }
-  throw new Error(`Could not locate test fixture "${name}"`);
+  return path.resolve(process.cwd(), 'test', 'fixtures');
+}
+
+/** True when a TLS fixture can be produced, i.e. `openssl` is on PATH. */
+export function tlsFixtureAvailable(): boolean {
+  return ensureTlsFixture() !== null;
+}
+
+let cachedFixture: { key: Buffer; cert: Buffer } | null | undefined;
+
+function ensureTlsFixture(): { key: Buffer; cert: Buffer } | null {
+  if (cachedFixture !== undefined) return cachedFixture;
+
+  const dir = fixturesDir();
+  const keyPath = path.join(dir, 'self-signed-key.pem');
+  const certPath = path.join(dir, 'self-signed-cert.pem');
+
+  if (!fs.existsSync(keyPath) || !fs.existsSync(certPath)) {
+    try {
+      fs.mkdirSync(dir, { recursive: true });
+      execFileSync(
+        'openssl',
+        [
+          'req', '-x509', '-newkey', 'rsa:2048', '-nodes',
+          '-days', '7300',
+          '-subj', '/CN=localhost',
+          '-addext', 'subjectAltName=DNS:localhost,IP:127.0.0.1',
+          '-keyout', keyPath,
+          '-out', certPath,
+        ],
+        { stdio: 'ignore' },
+      );
+    } catch {
+      // No openssl. The TLS suite skips rather than failing the whole run.
+      cachedFixture = null;
+      return cachedFixture;
+    }
+  }
+
+  cachedFixture = { key: fs.readFileSync(keyPath), cert: fs.readFileSync(certPath) };
+  return cachedFixture;
 }
 
 type Frame = [number, (number | null)?, string?, unknown?];
@@ -113,10 +158,9 @@ export class FakeAdminServer {
   /** Set to true once a client has replied `[2]` to a server-initiated `[1]` ping. */
   pongReceived = false;
 
-  /** Binds `port` (default 0 = random free port) and resolves with the bound port. */
   /**
    * Binds `port` (0 = random free port) and resolves with it. With `tls: true` the
-   * server speaks HTTPS using the committed self-signed certificate, which is what
+   * server speaks HTTPS using a locally generated self-signed certificate, which is what
    * an auth-enabled ioBroker instance normally looks like.
    */
   start(port = 0, opts: { tls?: boolean } = {}): Promise<number> {
@@ -127,15 +171,17 @@ export class FakeAdminServer {
         void this.handleHttp(req, res);
       };
 
-      const httpServer = opts.tls
-        ? https.createServer(
-            {
-              key: fs.readFileSync(fixturePath('self-signed-key.pem')),
-              cert: fs.readFileSync(fixturePath('self-signed-cert.pem')),
-            },
-            handler,
-          )
-        : http.createServer(handler);
+      let httpServer: http.Server;
+      if (opts.tls) {
+        const fixture = ensureTlsFixture();
+        if (!fixture) {
+          reject(new Error('TLS mode needs openssl on PATH to generate a test certificate.'));
+          return;
+        }
+        httpServer = https.createServer({ key: fixture.key, cert: fixture.cert }, handler);
+      } else {
+        httpServer = http.createServer(handler);
+      }
       this.httpServer = httpServer;
 
       const wss = new WebSocket.Server({ server: httpServer });

test/fixtures/README.md

@@ -1,28 +1,21 @@
 # Test fixtures
 
-## `self-signed-cert.pem` / `self-signed-key.pem`
+## TLS certificate — generated, not committed
 
-A throwaway self-signed certificate for `localhost` / `127.0.0.1`, valid until 2046,
-used by `test/auth-tls.test.ts` to start the fake Admin server over HTTPS.
+`test/auth-tls.test.ts` needs a real TLS handshake, because an ioBroker instance with
+authentication enabled is normally also on HTTPS with a self-signed certificate, and
+`allowSelfSigned` cannot be exercised against a mock.
 
-**This key is deliberately committed and has no security value.** It protects nothing,
-is generated for this repository only, and is never used outside an in-process test
-server bound to a random loopback port.
+`test/fake-server.ts` generates `self-signed-key.pem` / `self-signed-cert.pem` here on
+first use and reuses them afterwards. Both are gitignored.
 
-It exists because an ioBroker instance with authentication enabled is normally also on
-HTTPS with a self-signed certificate — Admin will not take a password over plain HTTP.
-Testing the `allowSelfSigned` path therefore needs a real TLS handshake, not a mock.
+**Why generated rather than committed:** a committed private key — even a worthless one
+scoped to localhost — is flagged by every secret scanner, forever, and the false positive
+has to be re-triaged on each new scan. Generating costs roughly 150 ms once; the cached
+pair then makes every later run exactly as fast as a committed fixture would be.
 
-Regenerate with:
+Requires `openssl` on PATH. Without it the TLS suite **skips** rather than fails, so a
+contributor who lacks it still gets a green run — at the cost of not covering the HTTPS
+login path.
 
-```bash
-openssl req -x509 -newkey rsa:2048 -nodes -days 7300 \
-  -subj "/CN=localhost" \
-  -addext "subjectAltName=DNS:localhost,IP:127.0.0.1" \
-  -keyout self-signed-key.pem -out self-signed-cert.pem
-```
-
-> **Before making this repository public:** GitHub secret scanning flags committed
-> private keys, even harmless ones. Either accept the alert and dismiss it as a test
-> fixture, or switch to generating the pair at test-setup time (CI runners have
-> `openssl`).
+To force a fresh pair, delete the two `.pem` files and run the tests again.