fix: test

Author: patriksimek

.github/workflows/ci.yml

@@ -0,0 +1,21 @@
+name: CI
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: latest
+      - run: bun install --frozen-lockfile
+      - run: bun run test
+      - run: bun run test:integration
+      - run: bun run lint
+      - run: bun run typecheck
+      - run: bun run build

.github/workflows/release.yml

@@ -27,7 +27,9 @@ jobs:
         run: bun install --frozen-lockfile
 
       - name: Run tests
-        run: bun test
+        run: bun run test
+      - name: Run integration tests
+        run: bun run test:integration
 
   build:
     needs: test

src/commands/cert/issue.ts

@@ -111,24 +111,31 @@ export default defineCommand({
 
       const result = await client.certificates.issue(request);
 
-      if (args.json) {
-        output(result, { json: true });
-      } else if (args["out-cert"] || args["out-key"]) {
-        // Write files if requested
-        if (args["out-cert"]) {
-          writeFileSync(args["out-cert"], result.certificate.certificate_pem);
-          console.log(`Certificate written to ${args["out-cert"]}`);
-        }
+      // Write files if requested
+      if (args["out-cert"]) {
+        writeFileSync(args["out-cert"], result.certificate.certificate_pem);
+        console.log(`Certificate written to ${args["out-cert"]}`);
+      }
 
-        if (args["out-key"] && result.privateKey) {
-          writeFileSync(args["out-key"], result.privateKey, { mode: 0o600 });
-          console.log(`Private key written to ${args["out-key"]}`);
-        }
-      } else {
-        // Print PEM to stdout
-        console.log(result.certificate.certificate_pem);
-        if (result.privateKey) {
-          console.log(result.privateKey);
+      if (args["out-key"] && result.privateKey) {
+        writeFileSync(args["out-key"], result.privateKey, { mode: 0o600 });
+        console.log(`Private key written to ${args["out-key"]}`);
+      }
+
+      // Output result (unless files were written)
+      if (!args["out-cert"] && !args["out-key"]) {
+        if (args.json) {
+          output(result, { json: true });
+        } else {
+          // Output formatted key-value pairs
+          output({
+            id: result.certificate.id,
+            commonName: result.certificate.common_name,
+            validFrom: result.certificate.valid_from,
+            validTo: result.certificate.valid_to,
+            certificate: result.certificate.certificate_pem,
+            privateKey: result.privateKey ?? "",
+          }, { json: false });
         }
       }
     } catch (error) {

src/config.ts

@@ -23,8 +23,10 @@ export function loadConfigFile(): Config {
 }
 
 export function saveConfigFile(config: Config): void {
-  mkdirSync(dirname(CONFIG_PATH), { recursive: true });
-  writeFileSync(CONFIG_PATH, JSON.stringify(config, null, 2) + "\n");
+  mkdirSync(dirname(CONFIG_PATH), { recursive: true, mode: 0o700 });
+  writeFileSync(CONFIG_PATH, JSON.stringify(config, null, 2) + "\n", {
+    mode: 0o600,
+  });
 }
 
 export function getApiKey(cliFlag?: string): string | undefined {

tests/unit/commands/cert/issue.test.ts

@@ -62,16 +62,20 @@ describe("cert issue command", () => {
     vi.clearAllMocks();
   });
 
-  it("prints certificate and key PEM to stdout when no output files specified", async () => {
+  it("outputs formatted key-value pairs when no output files specified", async () => {
     await runCommand(issueCommand, {
       rawArgs: ["--ca-id", "ca-123"],
     });
 
-    expect(consoleSpy).toHaveBeenCalledWith(mockCertificateResult.certificate.certificate_pem);
-    expect(consoleSpy).toHaveBeenCalledWith(mockCertificateResult.privateKey);
+    // Verify key-value formatted output
+    const calls = consoleSpy.mock.calls.map(c => c[0]);
+    expect(calls.some(c => c.includes("id") && c.includes("cert-123"))).toBe(true);
+    expect(calls.some(c => c.includes("commonName") && c.includes("test.local"))).toBe(true);
+    expect(calls.some(c => c.includes("certificate") && c.includes("BEGIN CERTIFICATE"))).toBe(true);
+    expect(calls.some(c => c.includes("privateKey") && c.includes("BEGIN PRIVATE KEY"))).toBe(true);
   });
 
-  it("prints only certificate PEM when no private key returned (CSR mode)", async () => {
+  it("outputs formatted key-value pairs with empty privateKey when no private key returned (CSR mode)", async () => {
     mockIssue.mockResolvedValue({
       certificate: mockCertificateResult.certificate,
       privateKey: undefined,
@@ -81,8 +85,9 @@ describe("cert issue command", () => {
       rawArgs: ["--ca-id", "ca-123"],
     });
 
-    expect(consoleSpy).toHaveBeenCalledWith(mockCertificateResult.certificate.certificate_pem);
-    expect(consoleSpy).toHaveBeenCalledTimes(1);
+    const calls = consoleSpy.mock.calls.map(c => c[0]);
+    expect(calls.some(c => c.includes("id") && c.includes("cert-123"))).toBe(true);
+    expect(calls.some(c => c.includes("certificate") && c.includes("BEGIN CERTIFICATE"))).toBe(true);
   });
 
   it("outputs JSON when --json flag is provided", async () => {