feat(ocpp2): implement certificate management (ISO 15118) (#1685)

feat(ocpp2): implement certificate management (ISO 15118) (#1685)

* feat(ocpp2): add certificate message type definitions

* test(ocpp2): add certificate manager TDD tests (red phase)

* feat(ocpp2): implement certificate manager utility (26/30 tests pass, 4 blocked by test bugs)

* test(ocpp2): add InstallCertificate handler TDD tests (red phase)

* feat(ocpp2): implement InstallCertificate handler

- Add INSTALL_CERTIFICATE to OCPP20IncomingRequestCommand enum
- Implement handleRequestInstallCertificate() with validation and storage
- Handle both boolean (test mock) and object (real) return types
- All 9 handler tests passing

* test(ocpp2): add DeleteCertificate handler TDD tests

Add comprehensive test suite for OCPP 2.0.1 DeleteCertificate handler:
- Successful certificate deletion (Accepted status)
- Certificate not found scenario (NotFound status)
- Certificate manager missing (Failed with InternalError)
- Response structure validation

* test(ocpp2): add GetInstalledCertificateIds handler TDD tests

Add comprehensive test suite for OCPP 2.0.1 GetInstalledCertificateIds handler:
- Return all certificates when no filter provided
- Filter by certificate type (V2GRootCertificate, etc.)
- Multiple filter types support
- Empty result returns Accepted status (per OCPP spec)
- Certificate manager missing returns NotFound
- Response structure validation with CertificateHashDataChain

* fix(ocpp2): register GetCertificateStatus handler in incomingRequestHandlers Map

Handler implementation was complete but not registered in the Map,
causing OCPP messages to fail routing to the handler.

This completes Task 8 of certificate management implementation.

* test(ocpp2): add CertificateSigned handler TDD tests (red phase)

Add comprehensive test suite for CertificateSigned incoming request handler:
- Valid certificate chain installation (10 test cases)
- Invalid PEM format rejection
- ChargingStationCertificate reconnect logic
- V2GCertificate storage without reconnect
- Certificate manager missing error handling
- Storage failure handling scenarios
- Response structure validation

Export CertificateSigningUseEnumType from types/index.ts for test imports.

* feat(ocpp2): implement CertificateSigned handler

- Add handleRequestCertificateSigned method to process incoming signed certificates
- Validates PEM format and stores via CertificateManager
- Triggers websocket reconnect for ChargingStationCertificate type
- Returns Rejected with InternalError if certificateManager unavailable
- Export OCPP20CertificateSigned request/response types

* fix(ocpp2): resolve linting errors in CertificateSigned handler

- Fix import order: move OCPP20CertificateSignedRequest/Response before OCPP20ComponentName (perfectionist/sort-named-imports)
- Fix Map entry order: swap GET_BASE_REPORT and GET_CERTIFICATE_STATUS to alphabetical order (perfectionist/sort-maps)
- Fix method position: move handleRequestCertificateSigned to correct alphabetical position (perfectionist/sort-classes)
- Add eslint-disable comments for necessary any usage in certificateManager access (@typescript-eslint/no-unsafe-assignment)

* fix(ocpp2): resolve linting errors in certificate management

- Remove await from synchronous certificate manager method calls
- Remove async from test functions without await expressions
- Fix Promise.all() with non-Promise values in tests
- Auto-format code to match project style

All tests passing (125/125), build passes, 0 linting errors.

* feat(ocpp2): implement SignCertificate request method with mock CSR

- Add requestSignCertificate() method to OCPP20RequestService
- Generate simplified mock CSR for simulator testing (NOT PKCS#10 compliant)
- Extract OrganizationName from SecurityCtrlr.OrganizationName config
- Support optional CertificateSigningUseEnumType parameter
- Add comprehensive test suite (10 test scenarios)
- Fix all linting errors (import order, method order, JSDoc alignment)

Mock CSR Structure:
- JSON-based format with algorithm, keySize, publicKey, subject, timestamp
- Base64 encoded and wrapped in PEM headers
- NOT cryptographically valid PKCS#10 CSR
- Suitable for OCPP protocol testing in simulator context only

IMPORTANT: This implementation is for simulator testing purposes only.
Do NOT use in production environments. Real CSMS expecting valid PKCS#10
CSR will reject this format. No external dependencies added per plan
constraint (line 574).

Test Status:
- All linting passes (0 errors, 50 pre-existing warnings)
- Build passes (258ms)
- Tests cannot run due to poolifier ESM/CommonJS compatibility issue
  (documented in issues.md - not a code problem)

Refs: Task 9 - SignCertificate Request Method

* feat(ocpp2): implement Get15118EVCertificate and GetCertificateStatus request methods

Implements ISO 15118 certificate request methods:
- Get15118EVCertificate: forwards EXI-encoded cert requests (pass-through)
- GetCertificateStatus: requests OCSP certificate status from CSMS

Both methods follow established pattern (generateUUID -> sendMessage).
EXI payloads passed through unchanged (no decode/encode).
OCSP implementation is stub for simulator (no real network calls).

Tests: 12 comprehensive tests verify EXI pass-through and OCSP data flow.

* [autofix.ci] apply automated fixes

* fix(ocpp2): address PR review feedback for certificate management

- Fix toEndWith matcher: use toMatch(/\.pem$/) for vitest compatibility
- Fix path assertion: extract filename before checking special characters
- Fix GetInstalledCertificateIds: return NotFound when result is empty
- Fix deleteCertificate: return Failed instead of NotFound on outer error
- Add enum mapping: convert GetCertificateIdUseEnumType to InstallCertificateUseEnumType
- Fix JSDoc: remove duplicate @param and orphaned comment blocks
- Fix multi-cert PEM: use extractFirstCertificate for chained certificates
- Add comment to empty catch block explaining error swallowing intent

* test(ocpp20): align tests with OCPP 2.0.1 spec-compliant implementation

- GetInstalledCertificateIds: return NotFound (not Accepted) when no certificates match
- GetCertificateStatus: test stub behavior returning Failed/NotEnabled (OCSP not implemented)
- InstallCertificate: fix mock to return StoreCertificateResult object instead of boolean

* [autofix.ci] apply automated fixes

* [autofix.ci] apply automated fixes

* fix(tests): add missing hasIdTags mock method

The ChargingStationFactory mock was missing hasIdTags() method,
causing tests to fail on Windows when isIdTokenLocalAuthorized()
was called during authorization checks.

* fix(tests): align DeleteCertificate mock return type with handler expectation

The handler expects { status: 'Accepted' | 'NotFound' | 'Failed' } but the test
mock was returning boolean values, causing tests to fail on Windows CI.

* [autofix.ci] apply automated fixes

* fix(ocpp2): fix charging profile validation for stackLevel 0 and improve test isolation

- Fix validateChargingProfile() to use null checks instead of falsy checks,
  allowing valid profiles with stackLevel: 0 to pass validation
- Add resetConnectorTransactionState() helper in OCPP20TestUtils for proper
  test isolation between RequestStartTransaction tests
- Refactor test to verify connector status storage rather than TransactionEvent
  capture, improving test reliability across platforms

* fix: remove duplicate resetConnectorTransactionState function

* fix(ocpp2): address PR review issues for certificate management

- fix childCertificateHashData type to be array per OCPP 2.0.1 spec
- fix unsafe type casting using hasCertificateManager() type guard
- fix storeCertificate to accept CertificateSigningUseEnumType union
- remove unnecessary optional chain on storeResult.success
- document mock CSR behavior and OCSP stub limitation in README

* chore: untrack .sisyphus directory from PR

The .sisyphus directory contains local planning artifacts that should
not be part of the PR. It is now gitignored on main.

* fix: resolve linting warnings for clean format output

- Fix JSDoc @throws format in OCPP20CertificateManager.ts
- Add missing @param/@returns documentation for computeFallbackCertificateHash
- Add cspell dictionary entries for issuerkeyhash/issuernamehash
- Add cspell ignore directive for Base64 mock data strings
- Fix invalid string literals to proper ReasonCodeEnumType enum values

* fix(ocpp2): remove incorrect GetCertificateStatus incoming handler

OCPP 2.0.1 defines GetCertificateStatus as CS→CSMS (outgoing),
not CSMS→CS (incoming). The charging station sends OCSP requests
to the central system for certificate validation.

* docs: correct OCSP status and enable docs/ tracking

- Update README to reflect actual OCSP behavior (returns Failed, not Good)
- Remove docs/ from .gitignore to track OCPP specifications

* fix(ocpp2): rfc 6960 ocsp hash semantics and path traversal security

- Fix issuerKeyHash to use issuer certificate's public key per RFC 6960 4.1.1
- Add optional issuerCertPem parameter to computeCertificateHash
- Detect self-signed certificates and use correct key for hashing
- Add validateCertificatePath to prevent path traversal attacks
- Validate resolved paths stay within certificate storage directory
- Reject ../../../etc/passwd and /etc/passwd style attacks

* refactor(ocpp2): convert certificate manager file I/O to async

- Replace readFileSync/writeFileSync with async fs/promises equivalents
- Convert deleteCertificate, getInstalledCertificates, storeCertificate to async
- Add async pathExists helper using stat
- Update all test callers to use async/await
- Prevents blocking event loop during certificate file operations
- Fix lint: remove unnecessary escape in sanitizePath regex (Wave 2 cleanup)

* fix(ocpp2): use path.sep for cross-platform path validation

The path traversal check used hardcoded '/' separator which fails on Windows.
Using node:path sep constant ensures proper behavior on all platforms.

* fix(ocpp2): fix sanitizePath regex to properly remove path traversal sequences

The regex patterns in sanitizePath() were double-escaped in source,
causing them to not match actual '..' sequences or path separators.

- Change /\.\./g to /\.\./g to match literal '..'
- Change /[/\\]/g to /[/\]/g to match / and \ characters
- Replace matches with '_' instead of empty string for clarity

* test(ocpp2): remove obsolete GetCertificateStatus incoming handler tests

The GetCertificateStatus incoming handler was removed in a previous commit
because GetCertificateStatus is an outgoing request per OCPP 2.0.1 spec,
not an incoming message that the charging station handles.

These tests were testing a handler that no longer exists.

* fix(ocpp2): add OCPP 2.0.1 §2.10 TxProfile validation for RequestStartTransaction

- Validate chargingProfilePurpose must be TxProfile (reject TxDefaultProfile, etc.)
- Validate transactionId must not be set for new transaction profiles
- Fixes Windows CI test failures for RequestStartTransaction tests

* refactor(ocpp2): improve CertificateManager code quality

- Add explanatory comments to empty catch blocks for clarity
- Extract getStationCertificatesBasePath() helper to reduce duplication
- Refactor deleteCertificate, getInstalledCertificates, getCertificatePath to use helper
- Fix spelling: unparseable → unparsable

* refactor(ocpp2): use DeleteCertificateStatusEnumType instead of string literals

Replace string literal union type with DeleteCertificateStatusEnumType enum:
- Update DeleteCertificateResult interface to use enum type
- Replace string literals in deleteCertificate method returns
- Replace string comparisons with enum values in handler

* feat(ocpp2): add TRIGGER_MESSAGE and UNLOCK_CONNECTOR to OCPP20IncomingRequestCommand enum

* refactor(ocpp2): use OCPP20IncomingRequestCommand enum for context.command type and comparisons

* chore: update openspec artifacts

Signed-off-by: Jérôme Benoit <jerome.benoit@sap.com>
* fix(deps): update all non-major dependencies (#1688)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
* chore(deps): update dependency @types/jsdom to v28 (#1689)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
* chore: update serena project configuration

Signed-off-by: Jérôme Benoit <jerome.benoit@sap.com>
* fix(ocpp2): implement ClearCache and Reset OnIdle fixes per audit (CLR-001, CLR-002, RST-001)

- Override handleRequestClearCache() for OCPP 2.0.1 to use Authorization Cache
- Add AuthCacheEnabled check per C11.FR.04 (return Rejected if disabled)
- Extend Reset OnIdle to check firmware updates and reservations per errata 2.14
- Add comprehensive test coverage for ClearCache spec compliance
- Update base class signature to support async ClearCache in OCPP 2.0.1
- Fix ESLint errors in test file (remove unnecessary conditionals, bind methods)

* test(ocpp2): add Reset OnIdle errata 2.14 compliance tests (RST-001)

- Add comprehensive test coverage for Reset OnIdle behavior
- Test firmware update blocking (Downloading/Downloaded/Installing states)
- Test reservation blocking (non-expired vs expired reservations)
- Test true idle state when all conditions clear
- Test multiple blocking conditions simultaneously
- All 116 tests passing with no regressions

* test(ocpp2): add C11.FR.05 test for Authorization Cache not supported scenario

* chore: cleanup type casting in OCPP 1.6

Signed-off-by: Jérôme Benoit <jerome.benoit@sap.com>
---------

Signed-off-by: Jérôme Benoit <jerome.benoit@sap.com>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>