Validate mTLS Bound Tokens

import "dotenv/config";
import express, { type Request } from "express";
import https from "https";
import fs from "fs";
import { TLSSocket } from "tls";
import { X509Certificate } from "crypto";
import {
  protectApi,
  type ClientCertificateResolver,
  type AuthenticatedExpressRequest,
} from "@monocloud/backend-node/express";

const app = express();
app.use(express.json());

// Resolve the client certificate from the TLS connection
const certificateResolver: ClientCertificateResolver<Request> = async (req) => {
  const { socket } = req;

  if (socket instanceof TLSSocket) {
    const cert = socket.getPeerCertificate(true);
    if (cert && cert.raw) {
      return new X509Certificate(cert.raw).toString();
    }
  }

  return "";
};

// Create the middleware with the certificate resolver
const protect = protectApi({ certificateResolver });

// Validate certificate binding on all routes
app.use(protect({ validateCertificateBinding: true }));

app.get("/api/data", (req, res) => {
  const { claims } = req as AuthenticatedExpressRequest;
  res.json({ claims });
});

// Create the HTTPS server
const server = https.createServer(
  {
    key: fs.readFileSync("<your-server-key.pem>"),
    cert: fs.readFileSync("<your-server-cert.pem>"),
    requestCert: true,
    rejectUnauthorized: false,
  },
  app
);

server.listen(3000, () => {
  console.log("HTTPS server running on https://localhost:3000");
});