Validate mTLS Bound Tokens

import "dotenv/config";
import Fastify, { type FastifyRequest } from "fastify";
import fs from "fs";
import { TLSSocket } from "tls";
import { X509Certificate } from "crypto";
import {
  protectApi,
  type ClientCertificateResolver,
  type AuthenticatedFastifyRequest,
} from "@monocloud/backend-node/fastify";

// Create Fastify with HTTPS and mTLS
const app = Fastify({
  https: {
    key: fs.readFileSync("<your-server-key.pem>"),
    cert: fs.readFileSync("<your-server-cert.pem>"),
    requestCert: true,
    rejectUnauthorized: false,
  },
});

// Resolve the client certificate from the TLS connection
const certificateResolver: ClientCertificateResolver<FastifyRequest> = async (
  request
) => {
  const { socket } = request;

  if (socket instanceof TLSSocket) {
    const cert = socket.getPeerCertificate(true);
    if (cert && cert.raw) {
      return new X509Certificate(cert.raw).toString();
    }
  }

  return "";
};

// Create the hook with the certificate resolver
const protect = protectApi({ certificateResolver });

// Validate certificate binding on all routes
app.addHook("onRequest", protect({ validateCertificateBinding: true }));

app.get("/api/data", async (request) => {
  const { claims } = request as AuthenticatedFastifyRequest;
  return { claims };
});

app.listen({ port: 3000 }, (err) => {
  if (err) throw err;
  console.log("HTTPS server running on https://localhost:3000");
});