certctl/internal/connector/issuer/acme/profile_test.go

package acme

import (
	"context"
	"crypto/ecdsa"
	"crypto/elliptic"
	"crypto/rand"
	"crypto/sha256"
	"encoding/base64"
	"encoding/json"
	"fmt"
	"io"
	"log/slog"
	"math/big"
	"net/http"
	"net/http/httptest"
	"os"
	"strings"
	"testing"

	goacme "golang.org/x/crypto/acme"
)

// verifyJWSSignature is a test helper that verifies a JWS signature.
func verifyJWSSignature(jwsJSON []byte, pubKey *ecdsa.PublicKey) error {
	var jws struct {
		Protected string `json:"protected"`
		Payload   string `json:"payload"`
		Signature string `json:"signature"`
	}

	if err := json.Unmarshal(jwsJSON, &jws); err != nil {
		return fmt.Errorf("unmarshal JWS: %w", err)
	}

	signingInput := jws.Protected + "." + jws.Payload
	hash := sha256.Sum256([]byte(signingInput))

	sigBytes, err := base64.RawURLEncoding.DecodeString(jws.Signature)
	if err != nil {
		return fmt.Errorf("decode signature: %w", err)
	}

	keyBytes := pubKey.Curve.Params().BitSize / 8
	if len(sigBytes) != 2*keyBytes {
		return fmt.Errorf("invalid signature length: %d (expected %d)", len(sigBytes), 2*keyBytes)
	}

	r := new(big.Int).SetBytes(sigBytes[:keyBytes])
	s := new(big.Int).SetBytes(sigBytes[keyBytes:])

	if !ecdsa.Verify(pubKey, hash[:], r, s) {
		return fmt.Errorf("signature verification failed")
	}

	return nil
}

func TestValidateConfig_ProfileValid(t *testing.T) {
	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		w.Header().Set("Content-Type", "application/json")
		fmt.Fprint(w, `{"newNonce":"","newAccount":"","newOrder":""}`)
	}))
	defer srv.Close()

	c := New(nil, testLogger())
	cfg, _ := json.Marshal(map[string]string{
		"directory_url": srv.URL,
		"email":         "test@example.com",
		"profile":       "shortlived",
	})
	err := c.ValidateConfig(context.Background(), cfg)
	if err != nil {
		t.Fatalf("expected success with valid profile, got: %v", err)
	}
	if c.config.Profile != "shortlived" {
		t.Errorf("expected profile 'shortlived', got: %s", c.config.Profile)
	}
}

func TestValidateConfig_ProfileTLSServer(t *testing.T) {
	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		w.Header().Set("Content-Type", "application/json")
		fmt.Fprint(w, `{"newNonce":"","newAccount":"","newOrder":""}`)
	}))
	defer srv.Close()

	c := New(nil, testLogger())
	cfg, _ := json.Marshal(map[string]string{
		"directory_url": srv.URL,
		"email":         "test@example.com",
		"profile":       "tlsserver",
	})
	err := c.ValidateConfig(context.Background(), cfg)
	if err != nil {
		t.Fatalf("expected success with valid profile, got: %v", err)
	}
}

func TestValidateConfig_ProfileEmpty(t *testing.T) {
	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		w.Header().Set("Content-Type", "application/json")
		fmt.Fprint(w, `{"newNonce":"","newAccount":"","newOrder":""}`)
	}))
	defer srv.Close()

	c := New(nil, testLogger())
	cfg, _ := json.Marshal(map[string]string{
		"directory_url": srv.URL,
		"email":         "test@example.com",
		"profile":       "",
	})
	err := c.ValidateConfig(context.Background(), cfg)
	if err != nil {
		t.Fatalf("expected success with empty profile, got: %v", err)
	}
	if c.config.Profile != "" {
		t.Errorf("expected empty profile, got: %s", c.config.Profile)
	}
}

func TestValidateConfig_ProfileInvalid(t *testing.T) {
	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		w.Header().Set("Content-Type", "application/json")
		fmt.Fprint(w, `{"newNonce":"","newAccount":"","newOrder":""}`)
	}))
	defer srv.Close()

	c := New(nil, testLogger())
	cfg, _ := json.Marshal(map[string]string{
		"directory_url": srv.URL,
		"email":         "test@example.com",
		"profile":       "short lived!",
	})
	err := c.ValidateConfig(context.Background(), cfg)
	if err == nil || !strings.Contains(err.Error(), "invalid profile") {
		t.Fatalf("expected invalid profile error, got: %v", err)
	}
}

func TestSignJWS_ES256(t *testing.T) {
	key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
	if err != nil {
		t.Fatal(err)
	}

	payload := []byte(`{"identifiers":[{"type":"dns","value":"example.com"}],"profile":"shortlived"}`)

	jwsBody, err := signJWS(key, "https://acme.example.com/acct/1", "nonce-abc", "https://acme.example.com/new-order", payload)
	if err != nil {
		t.Fatalf("signJWS failed: %v", err)
	}

	// Parse the JWS
	var jws struct {
		Protected string `json:"protected"`
		Payload   string `json:"payload"`
		Signature string `json:"signature"`
	}
	if err := json.Unmarshal(jwsBody, &jws); err != nil {
		t.Fatalf("JWS is not valid JSON: %v", err)
	}

	// Verify protected header
	headerBytes, err := base64.RawURLEncoding.DecodeString(jws.Protected)
	if err != nil {
		t.Fatalf("decode protected header: %v", err)
	}
	var header struct {
		Alg   string `json:"alg"`
		Kid   string `json:"kid"`
		Nonce string `json:"nonce"`
		URL   string `json:"url"`
	}
	if err := json.Unmarshal(headerBytes, &header); err != nil {
		t.Fatalf("parse header: %v", err)
	}
	if header.Alg != "ES256" {
		t.Errorf("expected alg ES256, got: %s", header.Alg)
	}
	if header.Kid != "https://acme.example.com/acct/1" {
		t.Errorf("expected kid URL, got: %s", header.Kid)
	}
	if header.Nonce != "nonce-abc" {
		t.Errorf("expected nonce, got: %s", header.Nonce)
	}
	if header.URL != "https://acme.example.com/new-order" {
		t.Errorf("expected url, got: %s", header.URL)
	}

	// Verify payload
	payloadBytes, err := base64.RawURLEncoding.DecodeString(jws.Payload)
	if err != nil {
		t.Fatalf("decode payload: %v", err)
	}
	var payloadObj struct {
		Profile string `json:"profile"`
	}
	if err := json.Unmarshal(payloadBytes, &payloadObj); err != nil {
		t.Fatalf("parse payload: %v", err)
	}
	if payloadObj.Profile != "shortlived" {
		t.Errorf("expected profile 'shortlived' in payload, got: %s", payloadObj.Profile)
	}

	// Verify signature
	if err := verifyJWSSignature(jwsBody, &key.PublicKey); err != nil {
		t.Fatalf("signature verification failed: %v", err)
	}
}

func TestAuthorizeOrderWithProfile_EmptyProfile_DelegatesToStandard(t *testing.T) {
	// When profile is empty, authorizeOrderWithProfile should call the standard
	// acme.Client.AuthorizeOrder. Since we can't mock a full ACME server for that,
	// we verify it returns an error (unreachable server) rather than trying the custom path.
	c := New(&Config{
		DirectoryURL:  "https://127.0.0.1:1/directory",
		Email:         "test@example.com",
		ChallengeType: "http-01",
		Profile:       "",
	}, testLogger())

	// Need to initialize the client first
	c.accountKey, _ = ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
	c.client = &goacme.Client{
		Key:          c.accountKey,
		DirectoryURL: c.config.DirectoryURL,
	}

	identifiers := []goacme.AuthzID{{Type: "dns", Value: "example.com"}}
	_, err := c.authorizeOrderWithProfile(context.Background(), identifiers, "")
	// Expected: network error from standard acme.Client.AuthorizeOrder
	if err == nil {
		t.Fatal("expected error from unreachable server")
	}
}

func TestAuthorizeOrderWithProfile_WithProfile_SendsProfileInBody(t *testing.T) {
	var receivedBody []byte

	// Mock ACME server that captures the newOrder request body
	mockSrv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		switch r.URL.Path {
		case "/directory":
			w.Header().Set("Content-Type", "application/json")
			json.NewEncoder(w).Encode(map[string]string{
				"newNonce":   r.Host + "/new-nonce",
				"newAccount": r.Host + "/new-account",
				"newOrder":   "http://" + r.Host + "/new-order",
			})
		case "/new-nonce":
			w.Header().Set("Replay-Nonce", "test-nonce-12345")
			w.WriteHeader(http.StatusOK)
		case "/acme/acct/1":
			// Account lookup
			w.Header().Set("Content-Type", "application/json")
			json.NewEncoder(w).Encode(map[string]interface{}{
				"status": "valid",
			})
		case "/new-order":
			// Capture the JWS body
			body, _ := io.ReadAll(r.Body)
			receivedBody = body

			// Return a valid order response
			w.Header().Set("Location", "http://"+r.Host+"/order/123")
			w.Header().Set("Content-Type", "application/json")
			json.NewEncoder(w).Encode(map[string]interface{}{
				"status": "pending",
				"identifiers": []map[string]string{
					{"type": "dns", "value": "example.com"},
				},
				"authorizations": []string{"http://" + r.Host + "/authz/1"},
				"finalize":       "http://" + r.Host + "/finalize/123",
			})
		default:
			http.NotFound(w, r)
		}
	}))
	defer mockSrv.Close()

	logger := slog.New(slog.NewTextHandler(os.Stderr, &slog.HandlerOptions{Level: slog.LevelError}))

	c := New(&Config{
		DirectoryURL:  mockSrv.URL + "/directory",
		Email:         "test@example.com",
		ChallengeType: "http-01",
		Profile:       "shortlived",
	}, logger)

	// Initialize client manually (bypass full ACME registration)
	key, _ := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
	c.accountKey = key
	c.client = &goacme.Client{
		Key:          key,
		DirectoryURL: c.config.DirectoryURL,
		HTTPClient:   c.httpClient(),
	}

	identifiers := []goacme.AuthzID{{Type: "dns", Value: "example.com"}}
	order, err := c.authorizeOrderWithProfile(context.Background(), identifiers, "shortlived")

	// The call may fail at GetReg since we're not running a real ACME server.
	// That's okay — we primarily want to verify the profile flow is entered.
	if err != nil {
		// Expected: GetReg will fail since we don't have a real ACME account.
		// But let's check if it at least tried the profile path by checking the error message.
		if strings.Contains(err.Error(), "ACME account") || strings.Contains(err.Error(), "JWS signing") || strings.Contains(err.Error(), "newOrder") {
			// This is expected — the profile path was entered but the mock doesn't support full ACME
			t.Logf("profile path entered, expected error from mock: %v", err)
			return
		}
		t.Fatalf("unexpected error: %v", err)
	}

	// If we got an order, verify it
	if order != nil {
		if order.Status != "pending" {
			t.Errorf("expected status pending, got: %s", order.Status)
		}

		// Verify the JWS body contained the profile field
		if len(receivedBody) > 0 {
			// Parse the JWS to extract the payload
			var jws struct {
				Payload string `json:"payload"`
			}
			if err := json.Unmarshal(receivedBody, &jws); err == nil {
				payloadBytes, _ := base64.RawURLEncoding.DecodeString(jws.Payload)
				var payload struct {
					Profile string `json:"profile"`
				}
				if err := json.Unmarshal(payloadBytes, &payload); err == nil {
					if payload.Profile != "shortlived" {
						t.Errorf("expected profile 'shortlived' in JWS payload, got: %q", payload.Profile)
					}
				}
			}
		}
	}
}

func TestProfileOrderRequest_NoProfile_OmitsField(t *testing.T) {
	req := profileOrderRequest{
		Identifiers: []wireAuthzID{{Type: "dns", Value: "example.com"}},
		Profile:     "",
	}

	data, err := json.Marshal(req)
	if err != nil {
		t.Fatal(err)
	}

	// With omitempty, empty profile should not appear in JSON
	if strings.Contains(string(data), "profile") {
		t.Errorf("expected no profile field in JSON when empty, got: %s", string(data))
	}
}

func TestProfileOrderRequest_WithProfile_IncludesField(t *testing.T) {
	req := profileOrderRequest{
		Identifiers: []wireAuthzID{{Type: "dns", Value: "example.com"}},
		Profile:     "shortlived",
	}

	data, err := json.Marshal(req)
	if err != nil {
		t.Fatal(err)
	}

	if !strings.Contains(string(data), `"profile":"shortlived"`) {
		t.Errorf("expected profile field in JSON, got: %s", string(data))
	}
}

func TestConfigProfileUnmarshal(t *testing.T) {
	// Verify that the factory (json.Unmarshal) correctly picks up the profile field
	configJSON := `{"directory_url":"https://acme.example.com/dir","email":"test@example.com","profile":"shortlived","ari_enabled":true}`

	var cfg Config
	if err := json.Unmarshal([]byte(configJSON), &cfg); err != nil {
		t.Fatalf("unmarshal failed: %v", err)
	}

	if cfg.Profile != "shortlived" {
		t.Errorf("expected profile 'shortlived', got: %q", cfg.Profile)
	}
	if cfg.DirectoryURL != "https://acme.example.com/dir" {
		t.Errorf("expected directory URL, got: %q", cfg.DirectoryURL)
	}
	if !cfg.ARIEnabled {
		t.Error("expected ARIEnabled true")
	}
}

func TestConfigProfileUnmarshal_Empty(t *testing.T) {
	// Empty profile should remain empty (backward compat)
	configJSON := `{"directory_url":"https://acme.example.com/dir","email":"test@example.com"}`

	var cfg Config
	if err := json.Unmarshal([]byte(configJSON), &cfg); err != nil {
		t.Fatalf("unmarshal failed: %v", err)
	}

	if cfg.Profile != "" {
		t.Errorf("expected empty profile, got: %q", cfg.Profile)
	}
}

func TestFetchNonce_Success(t *testing.T) {
	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		w.Header().Set("Replay-Nonce", "test-nonce-xyz")
		w.WriteHeader(http.StatusOK)
	}))
	defer srv.Close()

	c := New(&Config{
		DirectoryURL: srv.URL + "/directory",
	}, testLogger())

	nonce, err := c.fetchNonce(context.Background(), srv.URL+"/new-nonce")
	if err != nil {
		t.Fatalf("fetchNonce failed: %v", err)
	}
	if nonce != "test-nonce-xyz" {
		t.Errorf("expected nonce 'test-nonce-xyz', got: %s", nonce)
	}
}

func TestFetchNonce_MissingHeader(t *testing.T) {
	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		w.WriteHeader(http.StatusOK)
	}))
	defer srv.Close()

	c := New(&Config{
		DirectoryURL: srv.URL + "/directory",
	}, testLogger())

	_, err := c.fetchNonce(context.Background(), srv.URL+"/new-nonce")
	if err == nil || !strings.Contains(err.Error(), "Replay-Nonce") {
		t.Fatalf("expected missing nonce error, got: %v", err)
	}
}