Add CA bundle version and CA pinning status to the user-agent string

src/client.ts

@@ -69,10 +69,13 @@
       rejectUnauthorized: true,
     });
 
+    const userAgent = `${constants.USER_AGENT} node/${process.versions.node} v8/${process.versions.v8} ca_bundle/${constants.CA_BUNDLE_VERSION} (ca_pinning=${this.enableCAPinning ? 'enabled' : 'disabled'})`;
+
     this.axios = axios.create({
       baseURL: this.baseURL,
       httpsAgent: agent,
       httpAgent: Error('HTTP disabled. Must use HTTPS'),
+      headers: { 'User-Agent': userAgent },
     });
   }
 
@@ -108,7 +111,7 @@
    * @returns {string}
    * @memberof Client
    */
   private getExceptionFromResult(result: any): string {
     const { message, message_detail, error, error_description } = result;
 
     if (message && message_detail) return `${message}: ${message_detail}`;
@@ -311,11 +314,6 @@
       const { data } = await this.axios.post<TokenResponse>(
         this.TOKEN_ENDPOINT,
         new globalThis.URLSearchParams(request),
-        {
-          headers: {
-            'user-agent': `${constants.USER_AGENT} node/${process.versions.node} v8/${process.versions.v8}`,
-          },
-        },
       );
 
       /* Verify that we are receiving the expected response from Duo */

src/constants.ts

@@ -14,6 +14,7 @@ export const JTI_LENGTH = 36;
 export const JWT_EXPIRATION = 300;
 export const JWT_LEEWAY = 60;
 
+export const CA_BUNDLE_VERSION = '1.0';
 export const USER_AGENT = `duo_universal_node/${version}`;
 export const SIG_ALGORITHM = 'HS512';
 export const GRANT_TYPE = 'authorization_code';

test/client/client.test.ts

@@ -86,6 +86,34 @@ describe('Client instance', () => {
   });
 });
 
+describe('User Agent', () => {
+  let axiosCreateSpy: MockInstance;
+
+  beforeAll(() => {
+    axiosCreateSpy = vi.spyOn(axios, 'create').mockReturnThis();
+  });
+
+  it('User agent includes ca_bundle version and ca_pinning=enabled when pinning is on', () => {
+    new Client(clientOps);
+
+    const config = axiosCreateSpy.mock.lastCall?.[0];
+    const ua = config?.headers?.['User-Agent'] as string;
+
+    expect(ua).toContain(`ca_bundle/${constants.CA_BUNDLE_VERSION}`);
+    expect(ua).toContain('(ca_pinning=enabled)');
+  });
+
+  it('User agent includes ca_pinning=disabled when pinning is off', () => {
+    new Client({ ...clientOps, enableCAPinning: false });
+
+    const config = axiosCreateSpy.mock.lastCall?.[0];
+    const ua = config?.headers?.['User-Agent'] as string;
+
+    expect(ua).toContain(`ca_bundle/${constants.CA_BUNDLE_VERSION}`);
+    expect(ua).toContain('(ca_pinning=disabled)');
+  });
+});
+
 describe('CA Pinning', () => {
   let agentSpy: MockInstance;