mirror of
https://github.com/shankar0123/certctl.git
synced 2026-06-07 23:21:30 +00:00
shankar0123
36e722ba12
Uncommitted migration work at the time of branch cleanup. Tagged as checkpoint/m1-migration-wip so the commit survives git gc --prune=now. Session context: Phase 3 Part B+C of the M-1 sentinel error migration was in progress. 38 modified files, 4 new files (errors.go + errors_test.go in internal/service/ and internal/api/handler/). Resume from this commit via 'git checkout checkpoint/m1-migration-wip'.
355 lines
11 KiB
Go
355 lines
11 KiB
Go
package handler
|
|
|
|
import (
|
|
"context"
|
|
"encoding/json"
|
|
"fmt"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"strings"
|
|
"testing"
|
|
|
|
"github.com/shankar0123/certctl/internal/service"
|
|
)
|
|
|
|
// Add context import was already there — verify import is present above
|
|
|
|
// MockExportService is a mock implementation of ExportService interface.
|
|
type MockExportService struct {
|
|
ExportPEMFn func(ctx context.Context, certID string) (*service.ExportPEMResult, error)
|
|
ExportPKCS12Fn func(ctx context.Context, certID string, password string) ([]byte, error)
|
|
}
|
|
|
|
func (m *MockExportService) ExportPEM(ctx context.Context, certID string) (*service.ExportPEMResult, error) {
|
|
if m.ExportPEMFn != nil {
|
|
return m.ExportPEMFn(ctx, certID)
|
|
}
|
|
return nil, nil
|
|
}
|
|
|
|
func (m *MockExportService) ExportPKCS12(ctx context.Context, certID string, password string) ([]byte, error) {
|
|
if m.ExportPKCS12Fn != nil {
|
|
return m.ExportPKCS12Fn(ctx, certID, password)
|
|
}
|
|
return nil, nil
|
|
}
|
|
|
|
func TestExportPEM_Success(t *testing.T) {
|
|
mockSvc := &MockExportService{
|
|
ExportPEMFn: func(_ context.Context, certID string) (*service.ExportPEMResult, error) {
|
|
if certID != "mc-test-1" {
|
|
t.Errorf("expected certID mc-test-1, got %s", certID)
|
|
}
|
|
return &service.ExportPEMResult{
|
|
CertPEM: "-----BEGIN CERTIFICATE-----\nAAA\n-----END CERTIFICATE-----\n",
|
|
ChainPEM: "-----BEGIN CERTIFICATE-----\nBBB\n-----END CERTIFICATE-----\n",
|
|
FullPEM: "-----BEGIN CERTIFICATE-----\nAAA\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nBBB\n-----END CERTIFICATE-----\n",
|
|
}, nil
|
|
},
|
|
}
|
|
h := NewExportHandler(mockSvc)
|
|
|
|
req := httptest.NewRequest(http.MethodGet, "/api/v1/certificates/mc-test-1/export/pem", nil)
|
|
w := httptest.NewRecorder()
|
|
|
|
h.ExportPEM(w, req)
|
|
|
|
if w.Code != http.StatusOK {
|
|
t.Fatalf("expected 200, got %d", w.Code)
|
|
}
|
|
if ct := w.Header().Get("Content-Type"); ct != "application/json" {
|
|
t.Errorf("expected application/json content type, got %s", ct)
|
|
}
|
|
|
|
var result service.ExportPEMResult
|
|
if err := json.NewDecoder(w.Body).Decode(&result); err != nil {
|
|
t.Fatalf("failed to decode response: %v", err)
|
|
}
|
|
if result.CertPEM == "" {
|
|
t.Error("expected non-empty CertPEM")
|
|
}
|
|
if result.ChainPEM == "" {
|
|
t.Error("expected non-empty ChainPEM")
|
|
}
|
|
if result.FullPEM == "" {
|
|
t.Error("expected non-empty FullPEM")
|
|
}
|
|
}
|
|
|
|
func TestExportPEM_Download(t *testing.T) {
|
|
mockSvc := &MockExportService{
|
|
ExportPEMFn: func(_ context.Context, _ string) (*service.ExportPEMResult, error) {
|
|
return &service.ExportPEMResult{
|
|
CertPEM: "cert",
|
|
ChainPEM: "chain",
|
|
FullPEM: "full-pem-content",
|
|
}, nil
|
|
},
|
|
}
|
|
h := NewExportHandler(mockSvc)
|
|
|
|
req := httptest.NewRequest(http.MethodGet, "/api/v1/certificates/mc-test-1/export/pem?download=true", nil)
|
|
w := httptest.NewRecorder()
|
|
|
|
h.ExportPEM(w, req)
|
|
|
|
if w.Code != http.StatusOK {
|
|
t.Fatalf("expected 200, got %d", w.Code)
|
|
}
|
|
if ct := w.Header().Get("Content-Type"); ct != "application/x-pem-file" {
|
|
t.Errorf("expected application/x-pem-file, got %s", ct)
|
|
}
|
|
if cd := w.Header().Get("Content-Disposition"); cd != `attachment; filename="certificate.pem"` {
|
|
t.Errorf("expected Content-Disposition attachment, got %s", cd)
|
|
}
|
|
if w.Body.String() != "full-pem-content" {
|
|
t.Errorf("expected full-pem-content body, got %s", w.Body.String())
|
|
}
|
|
}
|
|
|
|
func TestExportPEM_NotFound(t *testing.T) {
|
|
// M-1 (P2): wrap with service.ErrNotFound via %w so the handler's
|
|
// errToStatus choke point dispatches to 404 via errors.Is. Pre-M-1 this
|
|
// test used a raw `fmt.Errorf("certificate not found")` string and relied
|
|
// on the handler's strings.Contains(err.Error(), "not found") classifier
|
|
// — which was the same mechanism that silently misclassified transient DB
|
|
// failures whose text happened to include "not found" (see docblock on
|
|
// ExportPEM handler). Pinning the sentinel contract makes this test
|
|
// regression-proof against wrap-text changes.
|
|
mockSvc := &MockExportService{
|
|
ExportPEMFn: func(_ context.Context, _ string) (*service.ExportPEMResult, error) {
|
|
return nil, fmt.Errorf("%w: certificate", service.ErrNotFound)
|
|
},
|
|
}
|
|
h := NewExportHandler(mockSvc)
|
|
|
|
req := httptest.NewRequest(http.MethodGet, "/api/v1/certificates/nonexistent/export/pem", nil)
|
|
w := httptest.NewRecorder()
|
|
|
|
h.ExportPEM(w, req)
|
|
|
|
if w.Code != http.StatusNotFound {
|
|
t.Fatalf("expected 404, got %d", w.Code)
|
|
}
|
|
}
|
|
|
|
func TestExportPEM_ServiceError(t *testing.T) {
|
|
mockSvc := &MockExportService{
|
|
ExportPEMFn: func(_ context.Context, _ string) (*service.ExportPEMResult, error) {
|
|
return nil, fmt.Errorf("internal error")
|
|
},
|
|
}
|
|
h := NewExportHandler(mockSvc)
|
|
|
|
req := httptest.NewRequest(http.MethodGet, "/api/v1/certificates/mc-test-1/export/pem", nil)
|
|
w := httptest.NewRecorder()
|
|
|
|
h.ExportPEM(w, req)
|
|
|
|
if w.Code != http.StatusInternalServerError {
|
|
t.Fatalf("expected 500, got %d", w.Code)
|
|
}
|
|
}
|
|
|
|
func TestExportPEM_MethodNotAllowed(t *testing.T) {
|
|
h := NewExportHandler(&MockExportService{})
|
|
|
|
req := httptest.NewRequest(http.MethodPost, "/api/v1/certificates/mc-test-1/export/pem", nil)
|
|
w := httptest.NewRecorder()
|
|
|
|
h.ExportPEM(w, req)
|
|
|
|
if w.Code != http.StatusMethodNotAllowed {
|
|
t.Fatalf("expected 405, got %d", w.Code)
|
|
}
|
|
}
|
|
|
|
func TestExportPKCS12_Success(t *testing.T) {
|
|
pfxData := []byte{0x30, 0x82, 0x01, 0x00} // mock PKCS#12 data
|
|
mockSvc := &MockExportService{
|
|
ExportPKCS12Fn: func(_ context.Context, certID string, password string) ([]byte, error) {
|
|
if certID != "mc-test-1" {
|
|
t.Errorf("expected certID mc-test-1, got %s", certID)
|
|
}
|
|
if password != "mysecret" {
|
|
t.Errorf("expected password mysecret, got %s", password)
|
|
}
|
|
return pfxData, nil
|
|
},
|
|
}
|
|
h := NewExportHandler(mockSvc)
|
|
|
|
body := strings.NewReader(`{"password":"mysecret"}`)
|
|
req := httptest.NewRequest(http.MethodPost, "/api/v1/certificates/mc-test-1/export/pkcs12", body)
|
|
w := httptest.NewRecorder()
|
|
|
|
h.ExportPKCS12(w, req)
|
|
|
|
if w.Code != http.StatusOK {
|
|
t.Fatalf("expected 200, got %d", w.Code)
|
|
}
|
|
if ct := w.Header().Get("Content-Type"); ct != "application/x-pkcs12" {
|
|
t.Errorf("expected application/x-pkcs12, got %s", ct)
|
|
}
|
|
if cd := w.Header().Get("Content-Disposition"); cd != `attachment; filename="certificate.p12"` {
|
|
t.Errorf("expected Content-Disposition attachment, got %s", cd)
|
|
}
|
|
if len(w.Body.Bytes()) != len(pfxData) {
|
|
t.Errorf("expected %d bytes, got %d", len(pfxData), len(w.Body.Bytes()))
|
|
}
|
|
}
|
|
|
|
func TestExportPKCS12_EmptyPassword(t *testing.T) {
|
|
mockSvc := &MockExportService{
|
|
ExportPKCS12Fn: func(_ context.Context, _ string, password string) ([]byte, error) {
|
|
if password != "" {
|
|
t.Errorf("expected empty password, got %s", password)
|
|
}
|
|
return []byte{0x30}, nil
|
|
},
|
|
}
|
|
h := NewExportHandler(mockSvc)
|
|
|
|
// Empty body — password defaults to ""
|
|
req := httptest.NewRequest(http.MethodPost, "/api/v1/certificates/mc-test-1/export/pkcs12", nil)
|
|
w := httptest.NewRecorder()
|
|
|
|
h.ExportPKCS12(w, req)
|
|
|
|
if w.Code != http.StatusOK {
|
|
t.Fatalf("expected 200, got %d", w.Code)
|
|
}
|
|
}
|
|
|
|
func TestExportPKCS12_NotFound(t *testing.T) {
|
|
// M-1 (P2): same sentinel migration as TestExportPEM_NotFound — see
|
|
// rationale there.
|
|
mockSvc := &MockExportService{
|
|
ExportPKCS12Fn: func(_ context.Context, _ string, _ string) ([]byte, error) {
|
|
return nil, fmt.Errorf("%w: certificate", service.ErrNotFound)
|
|
},
|
|
}
|
|
h := NewExportHandler(mockSvc)
|
|
|
|
req := httptest.NewRequest(http.MethodPost, "/api/v1/certificates/nonexistent/export/pkcs12", nil)
|
|
w := httptest.NewRecorder()
|
|
|
|
h.ExportPKCS12(w, req)
|
|
|
|
if w.Code != http.StatusNotFound {
|
|
t.Fatalf("expected 404, got %d", w.Code)
|
|
}
|
|
}
|
|
|
|
// TestExportPKCS12_Unprocessable pins the M-1 (P2) 422 contract: when the
|
|
// service layer wraps a parse failure with service.ErrUnprocessable, the
|
|
// handler's errToStatus choke point must dispatch to 422 Unprocessable
|
|
// Entity. Pre-M-1 this was classified via a 2-term substring net
|
|
// (`"cannot be parsed"|"no certificates found"`) at export.go:101, which
|
|
// would have been silently broken by a message reword in service/export.go.
|
|
// The new sentinel makes the dispatch survive message rewording.
|
|
func TestExportPKCS12_Unprocessable(t *testing.T) {
|
|
mockSvc := &MockExportService{
|
|
ExportPKCS12Fn: func(_ context.Context, _ string, _ string) ([]byte, error) {
|
|
return nil, fmt.Errorf("%w: certificate data cannot be parsed as X.509: asn1 decode error", service.ErrUnprocessable)
|
|
},
|
|
}
|
|
h := NewExportHandler(mockSvc)
|
|
|
|
req := httptest.NewRequest(http.MethodPost, "/api/v1/certificates/mc-test-1/export/pkcs12", nil)
|
|
w := httptest.NewRecorder()
|
|
|
|
h.ExportPKCS12(w, req)
|
|
|
|
if w.Code != http.StatusUnprocessableEntity {
|
|
t.Fatalf("expected 422, got %d", w.Code)
|
|
}
|
|
}
|
|
|
|
func TestExportPKCS12_ServiceError(t *testing.T) {
|
|
mockSvc := &MockExportService{
|
|
ExportPKCS12Fn: func(_ context.Context, _ string, _ string) ([]byte, error) {
|
|
return nil, fmt.Errorf("encoding error")
|
|
},
|
|
}
|
|
h := NewExportHandler(mockSvc)
|
|
|
|
req := httptest.NewRequest(http.MethodPost, "/api/v1/certificates/mc-test-1/export/pkcs12", nil)
|
|
w := httptest.NewRecorder()
|
|
|
|
h.ExportPKCS12(w, req)
|
|
|
|
if w.Code != http.StatusInternalServerError {
|
|
t.Fatalf("expected 500, got %d", w.Code)
|
|
}
|
|
}
|
|
|
|
func TestExportPKCS12_MethodNotAllowed(t *testing.T) {
|
|
h := NewExportHandler(&MockExportService{})
|
|
|
|
req := httptest.NewRequest(http.MethodGet, "/api/v1/certificates/mc-test-1/export/pkcs12", nil)
|
|
w := httptest.NewRecorder()
|
|
|
|
h.ExportPKCS12(w, req)
|
|
|
|
if w.Code != http.StatusMethodNotAllowed {
|
|
t.Fatalf("expected 405, got %d", w.Code)
|
|
}
|
|
}
|
|
|
|
func TestExtractCertIDFromExportPath(t *testing.T) {
|
|
tests := []struct {
|
|
path string
|
|
expected string
|
|
}{
|
|
{"/api/v1/certificates/mc-test-1/export/pem", "mc-test-1"},
|
|
{"/api/v1/certificates/mc-api-prod/export/pkcs12", "mc-api-prod"},
|
|
{"/api/v1/certificates//export/pem", ""},
|
|
{"/api/v1/other/mc-test-1/export/pem", ""},
|
|
{"/api/v1/certificates/mc-test-1", ""},
|
|
{"", ""},
|
|
}
|
|
|
|
for _, tt := range tests {
|
|
got := extractCertIDFromExportPath(tt.path)
|
|
if got != tt.expected {
|
|
t.Errorf("extractCertIDFromExportPath(%q) = %q, want %q", tt.path, got, tt.expected)
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestExportPKCS12_InvalidJSON(t *testing.T) {
|
|
mockSvc := &MockExportService{
|
|
ExportPKCS12Fn: func(_ context.Context, _ string, password string) ([]byte, error) {
|
|
// Invalid JSON is silently ignored, defaults to empty password
|
|
if password != "" {
|
|
t.Errorf("expected empty password (invalid JSON ignored), got %s", password)
|
|
}
|
|
return []byte{0x30}, nil
|
|
},
|
|
}
|
|
h := NewExportHandler(mockSvc)
|
|
|
|
req := httptest.NewRequest(http.MethodPost, "/api/v1/certificates/mc-test-1/export/pkcs12", strings.NewReader(`{"invalid json`))
|
|
w := httptest.NewRecorder()
|
|
|
|
h.ExportPKCS12(w, req)
|
|
|
|
if w.Code != http.StatusOK {
|
|
t.Fatalf("expected 200 (invalid JSON ignored), got %d", w.Code)
|
|
}
|
|
}
|
|
|
|
func TestExportPEM_MethodNotAllowedDelete(t *testing.T) {
|
|
h := NewExportHandler(&MockExportService{})
|
|
|
|
req := httptest.NewRequest(http.MethodDelete, "/api/v1/certificates/mc-test-1/export/pem", nil)
|
|
w := httptest.NewRecorder()
|
|
|
|
h.ExportPEM(w, req)
|
|
|
|
if w.Code != http.StatusMethodNotAllowed {
|
|
t.Fatalf("expected 405, got %d", w.Code)
|
|
}
|
|
}
|