15 files changed, 98 insertions, 0 deletions
diff --git a/cli/tests/testdata/cert/cafile_info.ts b/cli/tests/testdata/cert/cafile_info.ts
new file mode 100644
index 000000000..b41873f73
--- /dev/null
+++ b/cli/tests/testdata/cert/cafile_info.ts
@@ -0,0 +1,24 @@
+// When run against the test HTTP server, it will serve different media types
+// based on the URL containing `.t#.` strings, which exercises the different
+// mapping of media types end to end.
+
+import { loaded as loadedTs1 } from "https://localhost:5545/subdir/mt_text_typescript.t1.ts";
+import { loaded as loadedTs2 } from "https://localhost:5545/subdir/mt_video_vdn.t2.ts";
+import { loaded as loadedTs3 } from "https://localhost:5545/subdir/mt_video_mp2t.t3.ts";
+import { loaded as loadedTs4 } from "https://localhost:5545/subdir/mt_application_x_typescript.t4.ts";
+import { loaded as loadedJs1 } from "https://localhost:5545/subdir/mt_text_javascript.j1.js";
+import { loaded as loadedJs2 } from "https://localhost:5545/subdir/mt_application_ecmascript.j2.js";
+import { loaded as loadedJs3 } from "https://localhost:5545/subdir/mt_text_ecmascript.j3.js";
+import { loaded as loadedJs4 } from "https://localhost:5545/subdir/mt_application_x_javascript.j4.js";
+
+console.log(
+  "success",
+  loadedTs1,
+  loadedTs2,
+  loadedTs3,
+  loadedTs4,
+  loadedJs1,
+  loadedJs2,
+  loadedJs3,
+  loadedJs4,
+);
diff --git a/cli/tests/testdata/cert/cafile_info.ts.out b/cli/tests/testdata/cert/cafile_info.ts.out
new file mode 100644
index 000000000..4c7e6c6c7
--- /dev/null
+++ b/cli/tests/testdata/cert/cafile_info.ts.out
@@ -0,0 +1,13 @@
+local: [WILDCARD]https[WILDCARD]localhost_PORT5545[WILDCARD]
+type: TypeScript
+dependencies: 8 unique (total [WILDCARD])
+
+https://localhost:5545/cert/cafile_info.ts ([WILDCARD])
+├── https://localhost:5545/subdir/mt_application_ecmascript.j2.js ([WILDCARD])
+├── https://localhost:5545/subdir/mt_application_x_javascript.j4.js ([WILDCARD])
+├── https://localhost:5545/subdir/mt_application_x_typescript.t4.ts ([WILDCARD])
+├── https://localhost:5545/subdir/mt_text_ecmascript.j3.js ([WILDCARD])
+├── https://localhost:5545/subdir/mt_text_javascript.j1.js ([WILDCARD])
+├── https://localhost:5545/subdir/mt_text_typescript.t1.ts ([WILDCARD])
+├── https://localhost:5545/subdir/mt_video_mp2t.t3.ts ([WILDCARD])
+└── https://localhost:5545/subdir/mt_video_vdn.t2.ts ([WILDCARD])
diff --git a/cli/tests/testdata/cert/cafile_ts_fetch.ts b/cli/tests/testdata/cert/cafile_ts_fetch.ts
new file mode 100644
index 000000000..12fcda007
--- /dev/null
+++ b/cli/tests/testdata/cert/cafile_ts_fetch.ts
@@ -0,0 +1,3 @@
+fetch("https://localhost:5545/cert/cafile_ts_fetch.ts.out")
+  .then((r) => r.text())
+  .then((t) => console.log(t.trimEnd()));
diff --git a/cli/tests/testdata/cert/cafile_ts_fetch.ts.out b/cli/tests/testdata/cert/cafile_ts_fetch.ts.out
new file mode 100644
index 000000000..699b756ed
--- /dev/null
+++ b/cli/tests/testdata/cert/cafile_ts_fetch.ts.out
@@ -0,0 +1,2 @@
+[WILDCARD]
+Hello
diff --git a/cli/tests/testdata/cert/cafile_ts_fetch_unsafe_ssl.ts.out b/cli/tests/testdata/cert/cafile_ts_fetch_unsafe_ssl.ts.out
new file mode 100644
index 000000000..a0934e584
--- /dev/null
+++ b/cli/tests/testdata/cert/cafile_ts_fetch_unsafe_ssl.ts.out
@@ -0,0 +1,3 @@
+DANGER: TLS certificate validation is disabled for all hostnames
+[WILDCARD]
+Hello
diff --git a/cli/tests/testdata/cert/cafile_url_imports.ts b/cli/tests/testdata/cert/cafile_url_imports.ts
new file mode 100644
index 000000000..2355a8628
--- /dev/null
+++ b/cli/tests/testdata/cert/cafile_url_imports.ts
@@ -0,0 +1,3 @@
+import { printHello } from "https://localhost:5545/subdir/mod2.ts";
+printHello();
+console.log("success");
diff --git a/cli/tests/testdata/cert/cafile_url_imports.ts.out b/cli/tests/testdata/cert/cafile_url_imports.ts.out
new file mode 100644
index 000000000..989ce33e9
--- /dev/null
+++ b/cli/tests/testdata/cert/cafile_url_imports.ts.out
@@ -0,0 +1,2 @@
+Hello
+success
diff --git a/cli/tests/testdata/cert/cafile_url_imports_unsafe_ssl.ts.out b/cli/tests/testdata/cert/cafile_url_imports_unsafe_ssl.ts.out
new file mode 100644
index 000000000..daebcd766
--- /dev/null
+++ b/cli/tests/testdata/cert/cafile_url_imports_unsafe_ssl.ts.out
@@ -0,0 +1,3 @@
+DANGER: TLS certificate validation is disabled for: localhost
+Hello
+success
diff --git a/cli/tests/testdata/cert/deno_land_unsafe_ssl.ts b/cli/tests/testdata/cert/deno_land_unsafe_ssl.ts
new file mode 100644
index 000000000..f5e8dcc80
--- /dev/null
+++ b/cli/tests/testdata/cert/deno_land_unsafe_ssl.ts
@@ -0,0 +1,2 @@
+const r = await fetch("https://google.com");
+console.log(r.status);
diff --git a/cli/tests/testdata/cert/deno_land_unsafe_ssl.ts.out b/cli/tests/testdata/cert/deno_land_unsafe_ssl.ts.out
new file mode 100644
index 000000000..cbf52b076
--- /dev/null
+++ b/cli/tests/testdata/cert/deno_land_unsafe_ssl.ts.out
@@ -0,0 +1,2 @@
+DANGER: TLS certificate validation is disabled for: deno.land
+200
diff --git a/cli/tests/testdata/cert/ip_address_unsafe_ssl.ts b/cli/tests/testdata/cert/ip_address_unsafe_ssl.ts
new file mode 100644
index 000000000..a3268888f
--- /dev/null
+++ b/cli/tests/testdata/cert/ip_address_unsafe_ssl.ts
@@ -0,0 +1,2 @@
+const r = await fetch("https://1.1.1.1");
+console.log(r.status);
diff --git a/cli/tests/testdata/cert/ip_address_unsafe_ssl.ts.out b/cli/tests/testdata/cert/ip_address_unsafe_ssl.ts.out
new file mode 100644
index 000000000..d4ebb2617
--- /dev/null
+++ b/cli/tests/testdata/cert/ip_address_unsafe_ssl.ts.out
@@ -0,0 +1,2 @@
+DANGER: TLS certificate validation is disabled for: 1.1.1.1
+200
diff --git a/cli/tests/testdata/cert/listen_tls_alpn.ts b/cli/tests/testdata/cert/listen_tls_alpn.ts
new file mode 100644
index 000000000..b3ade686e
--- /dev/null
+++ b/cli/tests/testdata/cert/listen_tls_alpn.ts
@@ -0,0 +1,14 @@
+const listener = Deno.listenTls({
+  port: Number(Deno.args[0]),
+  certFile: "./tls/localhost.crt",
+  keyFile: "./tls/localhost.key",
+  alpnProtocols: ["h2", "http/1.1", "foobar"],
+});
+
+console.log("READY");
+
+const conn = await listener.accept() as Deno.TlsConn;
+await conn.handshake();
+conn.close();
+
+listener.close();
diff --git a/cli/tests/testdata/cert/listen_tls_alpn_fail.ts b/cli/tests/testdata/cert/listen_tls_alpn_fail.ts
new file mode 100644
index 000000000..da60383f0
--- /dev/null
+++ b/cli/tests/testdata/cert/listen_tls_alpn_fail.ts
@@ -0,0 +1,20 @@
+import { assertRejects } from "../../../../test_util/std/testing/asserts.ts";
+
+const listener = Deno.listenTls({
+  port: Number(Deno.args[0]),
+  certFile: "./tls/localhost.crt",
+  keyFile: "./tls/localhost.key",
+  alpnProtocols: ["h2", "http/1.1", "foobar"],
+});
+
+console.log("READY");
+
+const conn = await listener.accept() as Deno.TlsConn;
+await assertRejects(
+  () => conn.handshake(),
+  Deno.errors.InvalidData,
+  "peer doesn't support any known protocol",
+);
+conn.close();
+
+listener.close();
diff --git a/cli/tests/testdata/cert/localhost_unsafe_ssl.ts.out b/cli/tests/testdata/cert/localhost_unsafe_ssl.ts.out
new file mode 100644
index 000000000..0bfaeb25d
--- /dev/null
+++ b/cli/tests/testdata/cert/localhost_unsafe_ssl.ts.out
@@ -0,0 +1,3 @@
+DANGER: TLS certificate validation is disabled for: deno.land
+error: error sending request for url (https://localhost:5545/subdir/mod2.ts): error trying to connect: invalid peer certificate contents: invalid peer certificate: UnknownIssuer
+    at file:///[WILDCARD]/cafile_url_imports.ts:[WILDCARD]