From 5a9ee709efbb6db93d0142193d54b87e7a0e6dfb Mon Sep 17 00:00:00 2001 From: Julian Sommer <115516918+juliansommer@users.noreply.github.com> Date: Wed, 1 Jul 2026 10:52:05 +1000 Subject: [PATCH] chore: remove unused functions --- cmd/spinifex/cmd/admin.go | 2 +- spinifex/admin/admin.go | 76 ++-------------------------- spinifex/admin/admin_test.go | 50 ++++++------------ spinifex/gateway/eks/handler.go | 22 -------- spinifex/gateway/eks/handler_test.go | 25 --------- spinifex/services/nats/nats_test.go | 2 +- spinifex/utils/utils.go | 16 ------ 7 files changed, 20 insertions(+), 173 deletions(-) diff --git a/cmd/spinifex/cmd/admin.go b/cmd/spinifex/cmd/admin.go index ce206e2c9..d1b1516c9 100644 --- a/cmd/spinifex/cmd/admin.go +++ b/cmd/spinifex/cmd/admin.go @@ -2407,7 +2407,7 @@ func runCertRenew(cmd *cobra.Command, _ []string) { serverCertPath := filepath.Join(configDir, "server.pem") serverKeyPath := filepath.Join(configDir, "server.key") - if err := admin.GenerateSignedCertWithDNS(serverCertPath, serverKeyPath, caCertPath, caKeyPath, extraIPs, extraDNS); err != nil { + if err := admin.GenerateSignedCert(serverCertPath, serverKeyPath, caCertPath, caKeyPath, extraIPs, extraDNS); err != nil { fmt.Fprintf(os.Stderr, "Error regenerating server certificate: %v\n", err) os.Exit(1) } diff --git a/spinifex/admin/admin.go b/spinifex/admin/admin.go index 4194e5443..1b0ce0d48 100644 --- a/spinifex/admin/admin.go +++ b/spinifex/admin/admin.go @@ -197,7 +197,7 @@ func GenerateCertificatesIfNeeded(configDir string, force bool, bindIP string, a fmt.Printf(" CA Key: %s\n", caKeyPath) extraDNS := AWSGWServiceDNSNames(awsRegion, internalSuffix) - if err := GenerateSignedCertWithDNS(serverCertPath, serverKeyPath, caCertPath, caKeyPath, []string{bindIP}, extraDNS); err != nil { + if err := GenerateSignedCert(serverCertPath, serverKeyPath, caCertPath, caKeyPath, []string{bindIP}, extraDNS); err != nil { fmt.Fprintf(os.Stderr, "Error generating server certificate: %v\n", err) os.Exit(1) } @@ -233,7 +233,7 @@ func GenerateServerCertOnly(configDir string, bindIP, awsRegion, internalSuffix } extraDNS := AWSGWServiceDNSNames(awsRegion, internalSuffix) - return GenerateSignedCertWithDNS(serverCertPath, serverKeyPath, caCertPath, caKeyPath, []string{bindIP}, extraDNS) + return GenerateSignedCert(serverCertPath, serverKeyPath, caCertPath, caKeyPath, []string{bindIP}, extraDNS) } func CreateServiceDirectories(spxRoot string) { @@ -613,16 +613,9 @@ func DiscoverHostname() string { } // GenerateSignedCert generates a server certificate signed by the CA. -// extraIPs are additional IP addresses to include in the certificate's SANs. -// All non-loopback interface IPs on the local machine are automatically included. -func GenerateSignedCert(certPath, keyPath, caCertPath, caKeyPath string, extraIPs ...string) error { - return GenerateSignedCertWithDNS(certPath, keyPath, caCertPath, caKeyPath, extraIPs, nil) -} - -// GenerateSignedCertWithDNS generates a server certificate signed by the CA. // All non-loopback interface IPs and the machine hostname are automatically // included. extraIPs and extraDNS allow adding additional SANs. -func GenerateSignedCertWithDNS(certPath, keyPath, caCertPath, caKeyPath string, extraIPs, extraDNS []string) error { +func GenerateSignedCert(certPath, keyPath, caCertPath, caKeyPath string, extraIPs, extraDNS []string) error { caCertPEM, err := os.ReadFile(caCertPath) if err != nil { return fmt.Errorf("failed to read CA cert: %w", err) @@ -752,69 +745,6 @@ func GenerateSignedCertWithDNS(certPath, keyPath, caCertPath, caKeyPath string, return nil } -// GenerateSelfSignedCert generates a self-signed SSL certificate (legacy, kept for compatibility). -func GenerateSelfSignedCert(certPath, keyPath string) error { - privateKey, err := rsa.GenerateKey(rand.Reader, 4096) - if err != nil { - return fmt.Errorf("failed to generate private key: %w", err) - } - - notBefore := time.Now() - notAfter := notBefore.Add(3650 * 24 * time.Hour) // 10 years - - serialNumber, err := rand.Int(rand.Reader, new(big.Int).Lsh(big.NewInt(1), 128)) - if err != nil { - return fmt.Errorf("failed to generate serial number: %w", err) - } - - template := x509.Certificate{ - SerialNumber: serialNumber, - Subject: pkix.Name{ - CommonName: "localhost", - Organization: []string{"Spinifex Platform"}, - }, - NotBefore: notBefore, - NotAfter: notAfter, - KeyUsage: x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature, - ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth, x509.ExtKeyUsageClientAuth}, - BasicConstraintsValid: true, - DNSNames: []string{"localhost"}, - IPAddresses: []net.IP{net.ParseIP("127.0.0.1"), net.ParseIP("::1")}, - } - - derBytes, err := x509.CreateCertificate(rand.Reader, &template, &template, &privateKey.PublicKey, privateKey) - if err != nil { - return fmt.Errorf("failed to create certificate: %w", err) - } - - certOut, err := os.Create(certPath) - if err != nil { - return fmt.Errorf("failed to create cert file: %w", err) - } - defer certOut.Close() - - if err := pem.Encode(certOut, &pem.Block{Type: "CERTIFICATE", Bytes: derBytes}); err != nil { - return fmt.Errorf("failed to write cert: %w", err) - } - - keyOut, err := os.OpenFile(keyPath, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0600) - if err != nil { - return fmt.Errorf("failed to create key file: %w", err) - } - defer keyOut.Close() - - privBytes, err := x509.MarshalPKCS8PrivateKey(privateKey) - if err != nil { - return fmt.Errorf("failed to marshal private key: %w", err) - } - - if err := pem.Encode(keyOut, &pem.Block{Type: "PRIVATE KEY", Bytes: privBytes}); err != nil { - return fmt.Errorf("failed to write key: %w", err) - } - - return nil -} - // SetupAWSCredentials updates ~/.aws/credentials and ~/.aws/config. // When running under sudo, writes to SUDO_USER's home instead of root's. func SetupAWSCredentials(accessKey, secretKey, region, certPath, bindIP, wanIP string) error { diff --git a/spinifex/admin/admin_test.go b/spinifex/admin/admin_test.go index c37c1961f..7462549f7 100644 --- a/spinifex/admin/admin_test.go +++ b/spinifex/admin/admin_test.go @@ -326,7 +326,7 @@ func TestGenerateSignedCert(t *testing.T) { certPath := filepath.Join(dir, "server.pem") keyPath := filepath.Join(dir, "server.key") - require.NoError(t, GenerateSignedCert(certPath, keyPath, caCertPath, caKeyPath)) + require.NoError(t, GenerateSignedCert(certPath, keyPath, caCertPath, caKeyPath, nil, nil)) certPEM, _ := os.ReadFile(certPath) block, _ := pem.Decode(certPEM) @@ -368,7 +368,7 @@ func TestGenerateSignedCert(t *testing.T) { certPath := filepath.Join(dir, "server.pem") keyPath := filepath.Join(dir, "server.key") - require.NoError(t, GenerateSignedCert(certPath, keyPath, caCertPath, caKeyPath, "192.168.1.100")) + require.NoError(t, GenerateSignedCert(certPath, keyPath, caCertPath, caKeyPath, []string{"192.168.1.100"}, nil)) certPEM, _ := os.ReadFile(certPath) block, _ := pem.Decode(certPEM) @@ -389,7 +389,7 @@ func TestGenerateSignedCert(t *testing.T) { certPath := filepath.Join(dir, "server.pem") keyPath := filepath.Join(dir, "server.key") - require.NoError(t, GenerateSignedCert(certPath, keyPath, caCertPath, caKeyPath, "127.0.0.1", "::1", "0.0.0.0", "")) + require.NoError(t, GenerateSignedCert(certPath, keyPath, caCertPath, caKeyPath, []string{"127.0.0.1", "::1", "0.0.0.0", ""}, nil)) certPEM, _ := os.ReadFile(certPath) block, _ := pem.Decode(certPEM) @@ -401,7 +401,7 @@ func TestGenerateSignedCert(t *testing.T) { baseDir := t.TempDir() baseCert := filepath.Join(baseDir, "server.pem") baseKey := filepath.Join(baseDir, "server.key") - require.NoError(t, GenerateSignedCert(baseCert, baseKey, caCertPath, caKeyPath)) + require.NoError(t, GenerateSignedCert(baseCert, baseKey, caCertPath, caKeyPath, nil, nil)) basePEM, _ := os.ReadFile(baseCert) baseBlock, _ := pem.Decode(basePEM) baseParsed, _ := x509.ParseCertificate(baseBlock.Bytes) @@ -416,7 +416,7 @@ func TestGenerateSignedCert(t *testing.T) { badCACert := filepath.Join(dir, "bad-ca.pem") require.NoError(t, os.WriteFile(badCACert, []byte("not-a-cert"), 0600)) - err := GenerateSignedCert(filepath.Join(dir, "s.pem"), filepath.Join(dir, "s.key"), badCACert, caKeyPath) + err := GenerateSignedCert(filepath.Join(dir, "s.pem"), filepath.Join(dir, "s.key"), badCACert, caKeyPath, nil, nil) assert.Error(t, err) }) } @@ -452,7 +452,7 @@ func TestDiscoverHostname(t *testing.T) { } } -func TestGenerateSignedCertWithDNS_DedupDNS(t *testing.T) { +func TestGenerateSignedCert_DedupDNS(t *testing.T) { t.Parallel() caDir := t.TempDir() caCertPath := filepath.Join(caDir, "ca.pem") @@ -466,7 +466,7 @@ func TestGenerateSignedCertWithDNS_DedupDNS(t *testing.T) { // Pass "localhost" as extra DNS — should not duplicate the built-in entry. // Also pass empty strings and duplicates — should be ignored. extraDNS := []string{"localhost", "", "example.local", "example.local", ""} - require.NoError(t, GenerateSignedCertWithDNS(certPath, keyPath, caCertPath, caKeyPath, nil, extraDNS)) + require.NoError(t, GenerateSignedCert(certPath, keyPath, caCertPath, caKeyPath, nil, extraDNS)) certPEM, _ := os.ReadFile(certPath) block, _ := pem.Decode(certPEM) @@ -488,7 +488,7 @@ func TestGenerateSignedCertWithDNS_DedupDNS(t *testing.T) { assert.Contains(t, cert.DNSNames, "example.local") } -func TestGenerateSignedCertWithDNS_NilSlices(t *testing.T) { +func TestGenerateSignedCert_NilSlices(t *testing.T) { t.Parallel() caDir := t.TempDir() caCertPath := filepath.Join(caDir, "ca.pem") @@ -500,7 +500,7 @@ func TestGenerateSignedCertWithDNS_NilSlices(t *testing.T) { keyPath := filepath.Join(dir, "server.key") // Both slices nil — should still produce a valid cert with defaults. - require.NoError(t, GenerateSignedCertWithDNS(certPath, keyPath, caCertPath, caKeyPath, nil, nil)) + require.NoError(t, GenerateSignedCert(certPath, keyPath, caCertPath, caKeyPath, nil, nil)) certPEM, _ := os.ReadFile(certPath) block, _ := pem.Decode(certPEM) @@ -510,12 +510,12 @@ func TestGenerateSignedCertWithDNS_NilSlices(t *testing.T) { assert.GreaterOrEqual(t, len(cert.IPAddresses), 2, "should have at least loopback IPs") } -func TestGenerateSignedCertWithDNS_InvalidCA(t *testing.T) { +func TestGenerateSignedCert_InvalidCA(t *testing.T) { t.Parallel() dir := t.TempDir() // Missing CA cert file. - err := GenerateSignedCertWithDNS( + err := GenerateSignedCert( filepath.Join(dir, "s.pem"), filepath.Join(dir, "s.key"), filepath.Join(dir, "missing-ca.pem"), filepath.Join(dir, "missing-ca.key"), nil, nil, @@ -526,7 +526,7 @@ func TestGenerateSignedCertWithDNS_InvalidCA(t *testing.T) { // Corrupt CA cert. require.NoError(t, os.WriteFile(filepath.Join(dir, "bad-ca.pem"), []byte("not-pem"), 0600)) require.NoError(t, os.WriteFile(filepath.Join(dir, "bad-ca.key"), []byte("not-pem"), 0600)) - err = GenerateSignedCertWithDNS( + err = GenerateSignedCert( filepath.Join(dir, "s.pem"), filepath.Join(dir, "s.key"), filepath.Join(dir, "bad-ca.pem"), filepath.Join(dir, "bad-ca.key"), nil, nil, @@ -534,7 +534,7 @@ func TestGenerateSignedCertWithDNS_InvalidCA(t *testing.T) { assert.Error(t, err) } -func TestGenerateSignedCertWithDNS_ExtraDNS(t *testing.T) { +func TestGenerateSignedCert_ExtraDNS(t *testing.T) { t.Parallel() caDir := t.TempDir() caCertPath := filepath.Join(caDir, "ca.pem") @@ -547,7 +547,7 @@ func TestGenerateSignedCertWithDNS_ExtraDNS(t *testing.T) { extraIPs := []string{"10.0.0.42"} extraDNS := []string{"spinifex.local", "node1.spinifex.local"} - require.NoError(t, GenerateSignedCertWithDNS(certPath, keyPath, caCertPath, caKeyPath, extraIPs, extraDNS)) + require.NoError(t, GenerateSignedCert(certPath, keyPath, caCertPath, caKeyPath, extraIPs, extraDNS)) certPEM, _ := os.ReadFile(certPath) block, _ := pem.Decode(certPEM) @@ -579,7 +579,7 @@ func TestGenerateSignedCert_IncludesHostname(t *testing.T) { dir := t.TempDir() certPath := filepath.Join(dir, "server.pem") keyPath := filepath.Join(dir, "server.key") - require.NoError(t, GenerateSignedCert(certPath, keyPath, caCertPath, caKeyPath)) + require.NoError(t, GenerateSignedCert(certPath, keyPath, caCertPath, caKeyPath, nil, nil)) certPEM, _ := os.ReadFile(certPath) block, _ := pem.Decode(certPEM) @@ -593,26 +593,6 @@ func TestGenerateSignedCert_IncludesHostname(t *testing.T) { } } -func TestGenerateSelfSignedCert_CreatesValidCert(t *testing.T) { - t.Parallel() - dir := t.TempDir() - certPath := filepath.Join(dir, "self.pem") - keyPath := filepath.Join(dir, "self.key") - - require.NoError(t, GenerateSelfSignedCert(certPath, keyPath)) - - certPEM, _ := os.ReadFile(certPath) - block, _ := pem.Decode(certPEM) - require.NotNil(t, block) - - cert, err := x509.ParseCertificate(block.Bytes) - require.NoError(t, err) - assert.Contains(t, cert.DNSNames, "localhost") - - info, _ := os.Stat(keyPath) - assert.Equal(t, os.FileMode(0600), info.Mode().Perm()) -} - // --- Certificate orchestrator --- // TestGenerateCertificatesIfNeeded uses subtests to share the initial generation. diff --git a/spinifex/gateway/eks/handler.go b/spinifex/gateway/eks/handler.go index 2c60fc606..e9fe9f223 100644 --- a/spinifex/gateway/eks/handler.go +++ b/spinifex/gateway/eks/handler.go @@ -5,9 +5,7 @@ package gateway_eks import ( "encoding/json" - "errors" "fmt" - "io" "log/slog" "net/http" "strings" @@ -91,23 +89,3 @@ func WriteErrorFromCode(w http.ResponseWriter, code string) { } WriteJSONError(w, code, msg.Message, httpStatus) } - -// ParseJSONBody decodes the request body into an aws-sdk-go input struct. -// Empty bodies (valid for GET/DELETE) return a zero-valued struct. -func ParseJSONBody[T any](r *http.Request) (*T, error) { - out := new(T) - if r.Body == nil { - return out, nil - } - body, err := io.ReadAll(r.Body) - if err != nil { - return nil, fmt.Errorf("read body: %w", err) - } - if len(body) == 0 { - return out, nil - } - if err := json.Unmarshal(body, out); err != nil { - return nil, errors.New(awserrors.ErrorInvalidParameterValue) - } - return out, nil -} diff --git a/spinifex/gateway/eks/handler_test.go b/spinifex/gateway/eks/handler_test.go index 61eb300b8..75fc0c6c3 100644 --- a/spinifex/gateway/eks/handler_test.go +++ b/spinifex/gateway/eks/handler_test.go @@ -1,7 +1,6 @@ package gateway_eks import ( - "bytes" "encoding/json" "net/http" "net/http/httptest" @@ -111,27 +110,3 @@ func TestWriteJSONResponse_ListClustersWireShape(t *testing.T) { assert.NotContains(t, body, `"Clusters"`) assert.NotContains(t, body, `"NextToken"`) } - -type sampleInput struct { - Name string `json:"name"` -} - -func TestParseJSONBody_EmptyBodyOK(t *testing.T) { - req := httptest.NewRequest(http.MethodGet, "/clusters", nil) - got, err := ParseJSONBody[sampleInput](req) - require.NoError(t, err) - assert.Empty(t, got.Name) -} - -func TestParseJSONBody_DecodesBody(t *testing.T) { - req := httptest.NewRequest(http.MethodPost, "/clusters", bytes.NewReader([]byte(`{"name":"alpha"}`))) - got, err := ParseJSONBody[sampleInput](req) - require.NoError(t, err) - assert.Equal(t, "alpha", got.Name) -} - -func TestParseJSONBody_InvalidJSONErrors(t *testing.T) { - req := httptest.NewRequest(http.MethodPost, "/clusters", bytes.NewReader([]byte(`{not-json}`))) - _, err := ParseJSONBody[sampleInput](req) - require.Error(t, err) -} diff --git a/spinifex/services/nats/nats_test.go b/spinifex/services/nats/nats_test.go index bcd6db009..8ce5c7965 100644 --- a/spinifex/services/nats/nats_test.go +++ b/spinifex/services/nats/nats_test.go @@ -39,7 +39,7 @@ func TestRenderedConfig_EnforcesAuth(t *testing.T) { require.NoError(t, admin.GenerateCACert(caCertPath, caKeyPath)) serverCertPath := filepath.Join(tmpDir, "server.pem") serverKeyPath := filepath.Join(tmpDir, "server.key") - require.NoError(t, admin.GenerateSignedCert(serverCertPath, serverKeyPath, caCertPath, caKeyPath, "127.0.0.1")) + require.NoError(t, admin.GenerateSignedCert(serverCertPath, serverKeyPath, caCertPath, caKeyPath, []string{"127.0.0.1"}, nil)) // Read and render the production template. raw, err := os.ReadFile(templatePath(t)) diff --git a/spinifex/utils/utils.go b/spinifex/utils/utils.go index e2edd2511..4164c3be4 100644 --- a/spinifex/utils/utils.go +++ b/spinifex/utils/utils.go @@ -20,13 +20,9 @@ import ( "time" "github.com/aws/aws-sdk-go/aws" - "github.com/aws/aws-sdk-go/aws/credentials" - "github.com/aws/aws-sdk-go/aws/session" "github.com/aws/aws-sdk-go/private/protocol/xml/xmlutil" "github.com/aws/aws-sdk-go/service/ec2" - "github.com/aws/aws-sdk-go/service/s3" "github.com/mulgadc/spinifex/spinifex/awserrors" - "github.com/mulgadc/spinifex/spinifex/config" "github.com/pterm/pterm" ) @@ -160,18 +156,6 @@ func ValidateKeyPairName(name string) error { return nil } -func CreateS3Client(cfg *config.Config) *s3.S3 { - sess := session.Must(session.NewSession(&aws.Config{ - Region: aws.String(cfg.Predastore.Region), - Endpoint: aws.String(fmt.Sprintf("https://%s", cfg.Predastore.Host)), - Credentials: credentials.NewStaticCredentials(cfg.Predastore.AccessKey, cfg.Predastore.SecretKey, ""), - S3ForcePathStyle: aws.Bool(true), - DisableSSL: aws.Bool(false), - })) - - return s3.New(sess) -} - func DownloadFileWithProgress(url string, name string, filename string, timeout time.Duration) (err error) { ctx, cancel := context.WithCancel(context.Background()) if timeout > 0 {