mirror of
https://github.com/shankar0123/certctl.git
synced 2026-06-13 18:58:52 +00:00
feat: M25 post-deployment TLS verification + M26 Traefik/Caddy targets
M25: After deploying a certificate, the agent probes the live TLS
endpoint and compares SHA-256 fingerprints to verify the correct cert
is being served. Best-effort — failures don't block deployments.
New endpoints: POST /jobs/{id}/verify, GET /jobs/{id}/verification.
Migration 000008 adds verification columns to jobs table.
M26: Traefik target connector (file provider, auto-reload) and Caddy
target connector (dual-mode: admin API hot-reload or file-based).
Both wired into agent dispatch.
Also: restructured README to highlight supported integrations (issuers,
targets, notifiers) earlier, moved API/CLI/MCP sections lower. Updated
all docs (features, connectors, architecture, testing guide, why-certctl)
and fixed integration tests for 18-param RegisterHandlers signature.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
Shankar
@@ -0,0 +1,281 @@
|
||||
package service
|
||||
|
||||
import (
|
||||
"context"
|
||||
"errors"
|
||||
"log/slog"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"github.com/shankar0123/certctl/internal/domain"
|
||||
"github.com/shankar0123/certctl/internal/repository"
|
||||
)
|
||||
|
||||
// mockJobRepository is a test double for JobRepository.
|
||||
type mockJobRepository struct {
|
||||
jobs map[string]*domain.Job
|
||||
err error
|
||||
}
|
||||
|
||||
func (m *mockJobRepository) Get(ctx context.Context, id string) (*domain.Job, error) {
|
||||
if m.err != nil {
|
||||
return nil, m.err
|
||||
}
|
||||
job, ok := m.jobs[id]
|
||||
if !ok {
|
||||
return nil, errors.New("job not found")
|
||||
}
|
||||
return job, nil
|
||||
}
|
||||
|
||||
func (m *mockJobRepository) Create(ctx context.Context, job *domain.Job) error {
|
||||
m.jobs[job.ID] = job
|
||||
return nil
|
||||
}
|
||||
|
||||
func (m *mockJobRepository) Update(ctx context.Context, job *domain.Job) error {
|
||||
if m.err != nil {
|
||||
return m.err
|
||||
}
|
||||
m.jobs[job.ID] = job
|
||||
return nil
|
||||
}
|
||||
|
||||
func (m *mockJobRepository) List(ctx context.Context, filter *repository.JobFilter) ([]*domain.Job, error) {
|
||||
return nil, nil
|
||||
}
|
||||
|
||||
// mockAuditService is a test double for AuditService.
|
||||
type mockAuditService struct {
|
||||
events []interface{}
|
||||
}
|
||||
|
||||
func (m *mockAuditService) RecordEvent(ctx context.Context, actor string, actorType domain.ActorType, event string, resourceType string, resourceID string, details map[string]interface{}) {
|
||||
m.events = append(m.events, map[string]interface{}{
|
||||
"actor": actor,
|
||||
"actor_type": actorType,
|
||||
"event": event,
|
||||
"resource_type": resourceType,
|
||||
"resource_id": resourceID,
|
||||
"details": details,
|
||||
})
|
||||
}
|
||||
|
||||
func TestVerificationService_RecordVerificationResult_Success(t *testing.T) {
|
||||
ctx := context.Background()
|
||||
mockJobRepo := &mockJobRepository{
|
||||
jobs: map[string]*domain.Job{
|
||||
"j-test1": {
|
||||
ID: "j-test1",
|
||||
Status: domain.JobStatusCompleted,
|
||||
},
|
||||
},
|
||||
}
|
||||
mockAudit := &mockAuditService{events: []interface{}{}}
|
||||
service := NewVerificationService(mockJobRepo, mockAudit, slog.Default())
|
||||
|
||||
result := &domain.VerificationResult{
|
||||
JobID: "j-test1",
|
||||
TargetID: "t-nginx1",
|
||||
ExpectedFingerprint: "abc123",
|
||||
ActualFingerprint: "abc123",
|
||||
Verified: true,
|
||||
VerifiedAt: time.Now().UTC(),
|
||||
}
|
||||
|
||||
err := service.RecordVerificationResult(ctx, result)
|
||||
if err != nil {
|
||||
t.Errorf("unexpected error: %v", err)
|
||||
}
|
||||
|
||||
// Check job was updated
|
||||
job, _ := mockJobRepo.Get(ctx, "j-test1")
|
||||
if job.VerificationStatus != domain.VerificationSuccess {
|
||||
t.Errorf("expected VerificationSuccess, got %s", job.VerificationStatus)
|
||||
}
|
||||
if !*job.VerifiedAt == result.VerifiedAt {
|
||||
t.Errorf("verified_at mismatch")
|
||||
}
|
||||
|
||||
// Check audit event was recorded
|
||||
if len(mockAudit.events) != 1 {
|
||||
t.Errorf("expected 1 audit event, got %d", len(mockAudit.events))
|
||||
}
|
||||
}
|
||||
|
||||
func TestVerificationService_RecordVerificationResult_Failed(t *testing.T) {
|
||||
ctx := context.Background()
|
||||
mockJobRepo := &mockJobRepository{
|
||||
jobs: map[string]*domain.Job{
|
||||
"j-test2": {
|
||||
ID: "j-test2",
|
||||
Status: domain.JobStatusCompleted,
|
||||
},
|
||||
},
|
||||
}
|
||||
mockAudit := &mockAuditService{events: []interface{}{}}
|
||||
service := NewVerificationService(mockJobRepo, mockAudit, slog.Default())
|
||||
|
||||
result := &domain.VerificationResult{
|
||||
JobID: "j-test2",
|
||||
TargetID: "t-apache1",
|
||||
ExpectedFingerprint: "aaa111",
|
||||
ActualFingerprint: "bbb222",
|
||||
Verified: false,
|
||||
VerifiedAt: time.Now().UTC(),
|
||||
}
|
||||
|
||||
err := service.RecordVerificationResult(ctx, result)
|
||||
if err != nil {
|
||||
t.Errorf("unexpected error: %v", err)
|
||||
}
|
||||
|
||||
job, _ := mockJobRepo.Get(ctx, "j-test2")
|
||||
if job.VerificationStatus != domain.VerificationFailed {
|
||||
t.Errorf("expected VerificationFailed, got %s", job.VerificationStatus)
|
||||
}
|
||||
}
|
||||
|
||||
func TestVerificationService_RecordVerificationResult_WithError(t *testing.T) {
|
||||
ctx := context.Background()
|
||||
mockJobRepo := &mockJobRepository{
|
||||
jobs: map[string]*domain.Job{
|
||||
"j-test3": {
|
||||
ID: "j-test3",
|
||||
Status: domain.JobStatusCompleted,
|
||||
},
|
||||
},
|
||||
}
|
||||
mockAudit := &mockAuditService{events: []interface{}{}}
|
||||
service := NewVerificationService(mockJobRepo, mockAudit, slog.Default())
|
||||
|
||||
result := &domain.VerificationResult{
|
||||
JobID: "j-test3",
|
||||
TargetID: "t-haproxy1",
|
||||
VerifiedAt: time.Now().UTC(),
|
||||
Error: "connection refused",
|
||||
}
|
||||
|
||||
err := service.RecordVerificationResult(ctx, result)
|
||||
if err != nil {
|
||||
t.Errorf("unexpected error: %v", err)
|
||||
}
|
||||
|
||||
job, _ := mockJobRepo.Get(ctx, "j-test3")
|
||||
if job.VerificationStatus != domain.VerificationFailed {
|
||||
t.Errorf("expected VerificationFailed, got %s", job.VerificationStatus)
|
||||
}
|
||||
if job.VerificationError == nil || *job.VerificationError != "connection refused" {
|
||||
t.Error("expected verification error to be set")
|
||||
}
|
||||
}
|
||||
|
||||
func TestVerificationService_RecordVerificationResult_JobNotFound(t *testing.T) {
|
||||
ctx := context.Background()
|
||||
mockJobRepo := &mockJobRepository{
|
||||
jobs: map[string]*domain.Job{},
|
||||
}
|
||||
mockAudit := &mockAuditService{events: []interface{}{}}
|
||||
service := NewVerificationService(mockJobRepo, mockAudit, slog.Default())
|
||||
|
||||
result := &domain.VerificationResult{
|
||||
JobID: "j-nonexistent",
|
||||
TargetID: "t-nginx1",
|
||||
VerifiedAt: time.Now().UTC(),
|
||||
}
|
||||
|
||||
err := service.RecordVerificationResult(ctx, result)
|
||||
if err == nil {
|
||||
t.Error("expected error for nonexistent job")
|
||||
}
|
||||
}
|
||||
|
||||
func TestVerificationService_RecordVerificationResult_MissingJobID(t *testing.T) {
|
||||
ctx := context.Background()
|
||||
mockJobRepo := &mockJobRepository{jobs: map[string]*domain.Job{}}
|
||||
mockAudit := &mockAuditService{events: []interface{}{}}
|
||||
service := NewVerificationService(mockJobRepo, mockAudit, slog.Default())
|
||||
|
||||
result := &domain.VerificationResult{
|
||||
TargetID: "t-nginx1",
|
||||
VerifiedAt: time.Now().UTC(),
|
||||
}
|
||||
|
||||
err := service.RecordVerificationResult(ctx, result)
|
||||
if err == nil {
|
||||
t.Error("expected error for missing job ID")
|
||||
}
|
||||
}
|
||||
|
||||
func TestVerificationService_RecordVerificationResult_NilResult(t *testing.T) {
|
||||
ctx := context.Background()
|
||||
mockJobRepo := &mockJobRepository{jobs: map[string]*domain.Job{}}
|
||||
mockAudit := &mockAuditService{events: []interface{}{}}
|
||||
service := NewVerificationService(mockJobRepo, mockAudit, slog.Default())
|
||||
|
||||
err := service.RecordVerificationResult(ctx, nil)
|
||||
if err == nil {
|
||||
t.Error("expected error for nil result")
|
||||
}
|
||||
}
|
||||
|
||||
func TestVerificationService_GetVerificationResult_Success(t *testing.T) {
|
||||
ctx := context.Background()
|
||||
now := time.Now().UTC()
|
||||
targetID := "t-nginx1"
|
||||
fp := "abc123"
|
||||
mockJobRepo := &mockJobRepository{
|
||||
jobs: map[string]*domain.Job{
|
||||
"j-test1": {
|
||||
ID: "j-test1",
|
||||
TargetID: &targetID,
|
||||
VerificationStatus: domain.VerificationSuccess,
|
||||
VerifiedAt: &now,
|
||||
VerificationFp: &fp,
|
||||
},
|
||||
},
|
||||
}
|
||||
mockAudit := &mockAuditService{events: []interface{}{}}
|
||||
service := NewVerificationService(mockJobRepo, mockAudit, slog.Default())
|
||||
|
||||
result, err := service.GetVerificationResult(ctx, "j-test1")
|
||||
if err != nil {
|
||||
t.Errorf("unexpected error: %v", err)
|
||||
}
|
||||
|
||||
if result.JobID != "j-test1" {
|
||||
t.Errorf("expected job ID j-test1, got %s", result.JobID)
|
||||
}
|
||||
if !result.Verified {
|
||||
t.Error("expected Verified to be true")
|
||||
}
|
||||
if result.ActualFingerprint != "abc123" {
|
||||
t.Errorf("expected fingerprint abc123, got %s", result.ActualFingerprint)
|
||||
}
|
||||
}
|
||||
|
||||
func TestVerificationService_GetVerificationResult_NotFound(t *testing.T) {
|
||||
ctx := context.Background()
|
||||
mockJobRepo := &mockJobRepository{
|
||||
jobs: map[string]*domain.Job{},
|
||||
}
|
||||
mockAudit := &mockAuditService{events: []interface{}{}}
|
||||
service := NewVerificationService(mockJobRepo, mockAudit, slog.Default())
|
||||
|
||||
_, err := service.GetVerificationResult(ctx, "j-nonexistent")
|
||||
if err == nil {
|
||||
t.Error("expected error for nonexistent job")
|
||||
}
|
||||
}
|
||||
|
||||
func TestVerificationService_GetVerificationResult_EmptyJobID(t *testing.T) {
|
||||
ctx := context.Background()
|
||||
mockJobRepo := &mockJobRepository{jobs: map[string]*domain.Job{}}
|
||||
mockAudit := &mockAuditService{events: []interface{}{}}
|
||||
service := NewVerificationService(mockJobRepo, mockAudit, slog.Default())
|
||||
|
||||
_, err := service.GetVerificationResult(ctx, "")
|
||||
if err == nil {
|
||||
t.Error("expected error for empty job ID")
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user