fix: finish 2.9.0 plugin moves and get every check green

plugins/step-ca/package.json

@@ -6,7 +6,7 @@
   "scripts": {
     "build": "termix-plugin build",
     "test": "termix-plugin test",
-    "typecheck": "tsc -p tsconfig.json",
+    "typecheck": "tsc -b ../../tsconfig.plugins.json ../../tsconfig.plugins.frontend.json",
     "validate": "termix-plugin validate"
   },
   "dependencies": {

plugins/step-ca/src/backend/client.ts

@@ -396,3 +396,22 @@ export function parseSshCertificate(line: string): SshCertificateInfo {
     validBefore: toDate(validBefore),
   };
 }
+
+/** Save-time checks for the admin page: a bad URL or fingerprint says so there. */
+export function validateCaSettings(
+  values: Record<string, unknown>,
+): Record<string, string> {
+  const errors: Record<string, string> = {};
+  const check = (key: string, normalize: (raw: string) => string) => {
+    const value = values[key];
+    if (typeof value !== "string" || value.trim() === "") return;
+    try {
+      normalize(value);
+    } catch (error) {
+      errors[key] = error instanceof Error ? error.message : String(error);
+    }
+  };
+  check("caUrl", normalizeCaUrl);
+  check("fingerprint", normalizeFingerprint);
+  return errors;
+}

plugins/step-ca/src/backend/index.ts

@@ -6,8 +6,10 @@ import { createRuntime } from "./runtime.js";
 import { createAuthSessions } from "./auth-session.js";
 import { createStepCaProvider } from "./provider.js";
 import { PUBLIC_PATHS, registerRoutes } from "./routes.js";
+import { validateCaSettings } from "./client.js";
 
 export async function activate(ctx: PluginContext) {
+  ctx.settings.onValidate("admin", validateCaSettings);
   const table = await ctx.db.define(certsTable);
   const certs = createCertStore(ctx, table);
 

plugins/step-ca/tests/backend/settings-validation.test.ts

@@ -0,0 +1,25 @@
+import { describe, expect, it } from "vitest";
+import { validateCaSettings } from "../../src/backend/client.js";
+
+describe("validateCaSettings", () => {
+  it("accepts an https URL and a SHA-256 fingerprint", () => {
+    expect(
+      validateCaSettings({
+        caUrl: "https://ca.example.com:9000/",
+        fingerprint: "ab".repeat(32),
+      }),
+    ).toEqual({});
+  });
+
+  it("rejects a plain http URL and a short fingerprint at save time", () => {
+    const errors = validateCaSettings({
+      caUrl: "http://ca.example.com",
+      fingerprint: "abcd",
+    });
+    expect(Object.keys(errors).sort()).toEqual(["caUrl", "fingerprint"]);
+  });
+
+  it("leaves empty fields to the not-configured message", () => {
+    expect(validateCaSettings({ caUrl: "", fingerprint: " " })).toEqual({});
+  });
+});