399 lines
15 KiB
Go
399 lines
15 KiB
Go
package app
|
||
|
||
import (
|
||
"context"
|
||
"errors"
|
||
"strings"
|
||
"testing"
|
||
"time"
|
||
|
||
"git.pcux.cn/xuans/Scert/backend/internal/certificate"
|
||
"git.pcux.cn/xuans/Scert/backend/internal/httpapi"
|
||
"git.pcux.cn/xuans/Scert/backend/internal/notification"
|
||
"git.pcux.cn/xuans/Scert/backend/internal/repository"
|
||
)
|
||
|
||
type managementTestActivator struct {
|
||
readyErr error
|
||
activateErr error
|
||
calls int
|
||
}
|
||
|
||
func (a *managementTestActivator) Ready(context.Context, httpapi.ManagementCertificateState) error {
|
||
return a.readyErr
|
||
}
|
||
|
||
func (a *managementTestActivator) Activate(context.Context, httpapi.ManagementCertificateState, certificate.SavedResource) error {
|
||
a.calls++
|
||
return a.activateErr
|
||
}
|
||
|
||
type managementTestNotifier struct {
|
||
events []notification.Event
|
||
err error
|
||
}
|
||
|
||
func (n *managementTestNotifier) Send(_ context.Context, event notification.Event) error {
|
||
n.events = append(n.events, event)
|
||
return n.err
|
||
}
|
||
|
||
type managementFixture struct {
|
||
m *managementRenewal
|
||
app *App
|
||
state httpapi.ManagementCertificateState
|
||
policy certificate.RenewalPolicy
|
||
activator *managementTestActivator
|
||
notifier *managementTestNotifier
|
||
now time.Time
|
||
issues int
|
||
}
|
||
|
||
func newManagementFixture(t *testing.T) *managementFixture {
|
||
t.Helper()
|
||
cfg := readyApplicationConfig(t)
|
||
a, err := New(t.Context(), cfg)
|
||
if err != nil {
|
||
t.Fatal(err)
|
||
}
|
||
t.Cleanup(func() { _ = a.Close() })
|
||
f := &managementFixture{
|
||
app: a, now: time.Now().UTC(), activator: &managementTestActivator{}, notifier: &managementTestNotifier{},
|
||
policy: certificate.RenewalPolicy{
|
||
NearExpiryThreshold: 10 * 24 * time.Hour, RenewalThreshold: 6 * 24 * time.Hour,
|
||
UrgentThreshold: 3 * 24 * time.Hour, MaxRetries: 3, RetryInterval: time.Nanosecond,
|
||
},
|
||
}
|
||
f.state = httpapi.ManagementCertificateState{
|
||
Hostname: "random-admin.example.test", NotAfter: f.now.Add(4 * 24 * time.Hour),
|
||
HTTPSMode: "direct", DNSVerified: true, ManagementURL: "https://random-admin.example.test/",
|
||
Request: certificate.SetupCertificateRequest{
|
||
Domains: []string{"random-admin.example.test"}, CertificateType: "single",
|
||
ProviderID: "aliyun", CredentialRef: "secret://dns/test", Environment: "production",
|
||
},
|
||
}
|
||
f.m = &managementRenewal{
|
||
readState: func() (httpapi.ManagementCertificateState, error) { return f.state, nil },
|
||
issue: func(ctx context.Context, request certificate.SetupCertificateRequest) (certificate.SavedResource, error) {
|
||
if ctx.Err() != nil || len(request.Domains) != 1 || request.Domains[0] != f.state.Hostname || request.CredentialRef != f.state.Request.CredentialRef {
|
||
t.Fatalf("签发请求未使用当前管理配置：%+v", request)
|
||
}
|
||
f.issues++
|
||
return certificate.SavedResource{NotAfter: f.now.Add(90 * 24 * time.Hour), SerialNumber: "123"}, nil
|
||
},
|
||
activator: f.activator, tasks: a.Tasks,
|
||
audit: repository.NewSQLAuditRepository(a.Database.DB), notifier: f.notifier,
|
||
}
|
||
return f
|
||
}
|
||
|
||
func (f *managementFixture) assertTask(t *testing.T, status string, attempts int) repository.Task {
|
||
t.Helper()
|
||
items, err := f.app.Tasks.ListTasks(t.Context(), managementResourceID, 10)
|
||
if err != nil || len(items) != 1 {
|
||
t.Fatalf("管理任务未独立持久化：%+v %v", items, err)
|
||
}
|
||
item := items[0]
|
||
if item.ScopeType != repository.ScopeSystem || item.ProjectID != "" || item.OperatorID != "" {
|
||
t.Fatalf("管理任务没有保持系统范围：%+v", item)
|
||
}
|
||
if item.Status != status || item.FinishedAt == nil || item.TaskType != "management_renewal" {
|
||
t.Fatalf("管理任务终态异常：%+v", item)
|
||
}
|
||
trials, err := f.app.Tasks.ListAttempts(t.Context(), item.ID)
|
||
if err != nil || len(trials) != attempts {
|
||
t.Fatalf("管理任务尝试异常：%+v %v", trials, err)
|
||
}
|
||
for _, trial := range trials {
|
||
if trial.Status == "running" || trial.FinishedAt == nil {
|
||
t.Fatalf("尝试未收尾：%+v", trial)
|
||
}
|
||
}
|
||
var count int
|
||
if err := f.app.Database.DB.QueryRowContext(t.Context(), "SELECT COUNT(*) FROM audit_logs WHERE action = ? AND status = ?", "management_renewal", status).Scan(&count); err != nil || count != 1 {
|
||
t.Fatalf("管理续期审计缺失：%d %v", count, err)
|
||
}
|
||
if err := f.app.Database.DB.QueryRowContext(t.Context(), "SELECT COUNT(*) FROM audit_logs WHERE action = 'management_renewal' AND (task_id <> ? OR scope_type <> 'system' OR project_id <> '' OR operator_id <> '')", item.ID).Scan(&count); err != nil || count != 0 {
|
||
t.Fatalf("管理续期审计范围或关联错误：%d，%v", count, err)
|
||
}
|
||
return item
|
||
}
|
||
|
||
func TestManagementRenewalPersistsWithoutBusinessDomain(t *testing.T) {
|
||
f := newManagementFixture(t)
|
||
report, err := f.m.RunRenewal(t.Context(), f.policy, f.now)
|
||
if err != nil || report.Checked != 1 || report.Selected != 1 || report.Succeeded != 1 || f.issues != 1 || f.activator.calls != 1 {
|
||
t.Fatalf("管理续期未完成：%+v %v", report, err)
|
||
}
|
||
task := f.assertTask(t, "success", 1)
|
||
var count int
|
||
if err := f.app.Database.DB.QueryRowContext(t.Context(), "SELECT COUNT(*) FROM audit_logs WHERE task_id = ? AND status IN ('running', 'success')", task.ID).Scan(&count); err != nil || count != 2 {
|
||
t.Fatalf("正常管理续期缺少开始或收尾审计：%d，%v", count, err)
|
||
}
|
||
items, err := f.app.Repository.List(t.Context())
|
||
if err != nil || len(items) != 0 {
|
||
t.Fatalf("管理续期不得创建业务域名：%+v %v", items, err)
|
||
}
|
||
if len(f.notifier.events) != 1 || f.notifier.events[0].Domain != f.state.Hostname || f.notifier.events[0].CertificateSerial != "123" || f.notifier.events[0].ManagementURL != f.state.ManagementURL {
|
||
t.Fatalf("管理续期通知字段不完整：%+v", f.notifier.events)
|
||
}
|
||
}
|
||
|
||
func TestManagementRenewalSkipsFreshAndIPCertificates(t *testing.T) {
|
||
for _, name := range []string{"fresh", "ip", "near"} {
|
||
t.Run(name, func(t *testing.T) {
|
||
f := newManagementFixture(t)
|
||
f.state.NotAfter = f.now.Add(40 * 24 * time.Hour)
|
||
if name == "ip" {
|
||
f.state.Hostname = ""
|
||
}
|
||
if name == "near" {
|
||
f.state.NotAfter = f.now.Add(8 * 24 * time.Hour)
|
||
}
|
||
report, err := f.m.RunRenewal(t.Context(), f.policy, f.now)
|
||
if err != nil || report.Selected != 0 || f.issues != 0 || f.activator.calls != 0 || len(f.notifier.events) != 0 {
|
||
t.Fatalf("不应执行签发：%+v %v", report, err)
|
||
}
|
||
if name == "near" && report.NearExpiry != 1 {
|
||
t.Fatal("临期证书未纳入每日检查")
|
||
}
|
||
items, err := f.app.Tasks.ListTasks(t.Context(), "", 10)
|
||
if err != nil || len(items) != 0 {
|
||
t.Fatalf("跳过时不应产生任务：%v", err)
|
||
}
|
||
})
|
||
}
|
||
}
|
||
|
||
func TestManagementRenewalPreflightRejectsBeforeIssuance(t *testing.T) {
|
||
for _, name := range []string{"dns", "proxy", "no_listener"} {
|
||
t.Run(name, func(t *testing.T) {
|
||
f := newManagementFixture(t)
|
||
if name == "dns" {
|
||
f.state.DNSVerified = false
|
||
} else {
|
||
if name == "proxy" {
|
||
f.state.HTTPSMode = "proxy"
|
||
}
|
||
f.m.activator = directManagementActivator{server: f.app.HTTP}
|
||
}
|
||
report, err := f.m.RunRenewal(t.Context(), f.policy, f.now)
|
||
if err == nil || report.Failed != 1 || f.issues != 0 || f.activator.calls != 0 {
|
||
t.Fatalf("前置检查失败仍执行了签发：%+v %v", report, err)
|
||
}
|
||
f.assertTask(t, "failed", 0)
|
||
})
|
||
}
|
||
}
|
||
|
||
func TestManagementRenewalRetriesOnlyIssuance(t *testing.T) {
|
||
for _, name := range []string{"recover", "exhaust", "activation", "shorter"} {
|
||
t.Run(name, func(t *testing.T) {
|
||
f := newManagementFixture(t)
|
||
f.state.NotAfter = f.now.Add(2 * 24 * time.Hour)
|
||
baseIssue := f.m.issue
|
||
calls := 0
|
||
f.m.issue = func(ctx context.Context, request certificate.SetupCertificateRequest) (certificate.SavedResource, error) {
|
||
calls++
|
||
if name == "exhaust" || (name == "recover" && calls < 3) {
|
||
return certificate.SavedResource{}, errors.New("测试凭据不得出现在通知中")
|
||
}
|
||
saved, err := baseIssue(ctx, request)
|
||
if name == "shorter" {
|
||
saved.NotAfter = f.state.NotAfter
|
||
}
|
||
return saved, err
|
||
}
|
||
if name == "activation" {
|
||
f.activator.activateErr = errors.New("模拟代理激活失败")
|
||
}
|
||
report, err := f.m.RunRenewal(t.Context(), f.policy, f.now)
|
||
wantAttempts, status := 1, "failed"
|
||
if name == "recover" || name == "exhaust" {
|
||
wantAttempts = 3
|
||
}
|
||
if name == "recover" {
|
||
status = "success"
|
||
}
|
||
if calls != wantAttempts || (err == nil) != (status == "success") || report.Urgent != 1 {
|
||
t.Fatalf("重试范围错误：calls=%d report=%+v err=%v", calls, report, err)
|
||
}
|
||
f.assertTask(t, status, wantAttempts)
|
||
if len(f.notifier.events) != 1 || f.notifier.events[0].Status != status || strings.Contains(f.notifier.events[0].Error, "测试凭据") {
|
||
t.Fatalf("通知状态错误或泄露错误细节：%+v", f.notifier.events)
|
||
}
|
||
})
|
||
}
|
||
}
|
||
|
||
func TestManagementRenewalCancellationPersistsTerminalState(t *testing.T) {
|
||
for _, name := range []string{"issue", "retry_wait"} {
|
||
t.Run(name, func(t *testing.T) {
|
||
f := newManagementFixture(t)
|
||
f.state.NotAfter = f.now.Add(time.Hour)
|
||
ctx, cancel := context.WithCancel(t.Context())
|
||
defer cancel()
|
||
f.m.issue = func(context.Context, certificate.SetupCertificateRequest) (certificate.SavedResource, error) {
|
||
f.issues++
|
||
if name == "issue" {
|
||
cancel()
|
||
return certificate.SavedResource{}, ctx.Err()
|
||
}
|
||
return certificate.SavedResource{}, errors.New("模拟签发失败")
|
||
}
|
||
f.m.wait = func(ctx context.Context, _ time.Duration) error { cancel(); return ctx.Err() }
|
||
report, err := f.m.RunRenewal(ctx, f.policy, f.now)
|
||
if !errors.Is(err, context.Canceled) || report.Failed != 1 || f.issues != 1 || f.activator.calls != 0 {
|
||
t.Fatalf("取消后仍继续执行：%+v %v", report, err)
|
||
}
|
||
f.assertTask(t, "cancelled", 1)
|
||
})
|
||
}
|
||
}
|
||
|
||
type managementFailTasks struct {
|
||
repository.TaskRepository
|
||
failure string
|
||
}
|
||
|
||
func (r managementFailTasks) CreateTask(ctx context.Context, item repository.Task) error {
|
||
if r.failure == "create" {
|
||
return errors.New("模拟任务写入失败")
|
||
}
|
||
return r.TaskRepository.CreateTask(ctx, item)
|
||
}
|
||
|
||
func (r managementFailTasks) CreateAttempt(ctx context.Context, item repository.TaskAttempt) error {
|
||
if r.failure == "attempt" {
|
||
return errors.New("模拟尝试写入失败")
|
||
}
|
||
return r.TaskRepository.CreateAttempt(ctx, item)
|
||
}
|
||
|
||
func TestManagementRenewalDoesNotIssueWithoutPersistentTask(t *testing.T) {
|
||
for _, failure := range []string{"create", "attempt"} {
|
||
t.Run(failure, func(t *testing.T) {
|
||
f := newManagementFixture(t)
|
||
f.m.tasks = managementFailTasks{TaskRepository: f.app.Tasks, failure: failure}
|
||
report, err := f.m.RunRenewal(t.Context(), f.policy, f.now)
|
||
if err == nil || report.Failed != 1 || f.issues != 0 || f.activator.calls != 0 {
|
||
t.Fatalf("无任务记录仍签发：%+v %v", report, err)
|
||
}
|
||
if failure == "attempt" {
|
||
f.assertTask(t, "failed", 0)
|
||
}
|
||
})
|
||
}
|
||
}
|
||
|
||
func TestManagementRenewalRejectsConcurrentRuns(t *testing.T) {
|
||
f := newManagementFixture(t)
|
||
f.m.mu.Lock()
|
||
defer f.m.mu.Unlock()
|
||
if _, err := f.m.RunRenewal(t.Context(), f.policy, f.now); err == nil || f.issues != 0 {
|
||
t.Fatal("未拒绝重复续期")
|
||
}
|
||
}
|
||
|
||
func TestManagementRenewalNotificationFailureDoesNotRepeatIssuance(t *testing.T) {
|
||
f := newManagementFixture(t)
|
||
f.notifier.err = errors.New("模拟邮件发送失败")
|
||
logged := false
|
||
f.m.notifyError = func(error) { logged = true }
|
||
report, err := f.m.RunRenewal(t.Context(), f.policy, f.now)
|
||
if err != nil || report.Succeeded != 1 || !logged || f.issues != 1 {
|
||
t.Fatalf("通知失败不应重复签发：%+v %v", report, err)
|
||
}
|
||
f.assertTask(t, "success", 1)
|
||
}
|
||
|
||
func TestManagementRenewalRecordsUnreadableCertificate(t *testing.T) {
|
||
f := newManagementFixture(t)
|
||
f.m.readState = func() (httpapi.ManagementCertificateState, error) {
|
||
return f.state, errors.New("模拟管理证书文件读取失败")
|
||
}
|
||
logged := false
|
||
f.m.notifyError = func(error) { logged = true }
|
||
report, err := f.m.RunRenewal(t.Context(), f.policy, f.now)
|
||
if err == nil || report.Checked != 1 || report.Failed != 1 || !logged || f.issues != 0 {
|
||
t.Fatalf("读取错误没有持久化失败证据：%+v %v", report, err)
|
||
}
|
||
f.assertTask(t, "failed", 0)
|
||
if len(f.notifier.events) != 1 || f.notifier.events[0].Status != "failed" {
|
||
t.Fatal("证书读取失败没有通知")
|
||
}
|
||
}
|
||
|
||
func TestManagementRenewalRecordsUnreadableEmptyState(t *testing.T) {
|
||
f := newManagementFixture(t)
|
||
f.m.readState = func() (httpapi.ManagementCertificateState, error) {
|
||
return httpapi.ManagementCertificateState{}, errors.New("empty management certificate state read failure")
|
||
}
|
||
report, err := f.m.RunRenewal(t.Context(), f.policy, f.now)
|
||
if err == nil || report.Checked != 1 || report.Failed != 1 || f.issues != 0 {
|
||
t.Fatalf("empty state read failure was incorrectly skipped: %+v %v", report, err)
|
||
}
|
||
f.assertTask(t, "failed", 0)
|
||
}
|
||
|
||
type managementFailAudit struct {
|
||
repository.AuditRepository
|
||
}
|
||
|
||
func (r managementFailAudit) CreateAuditLog(ctx context.Context, item repository.AuditLog) error {
|
||
if item.Status == "running" {
|
||
return errors.New("模拟审计写入失败")
|
||
}
|
||
return r.AuditRepository.CreateAuditLog(ctx, item)
|
||
}
|
||
|
||
func TestManagementRenewalRejectsBeforeSideEffectsOnAuditFailure(t *testing.T) {
|
||
f := newManagementFixture(t)
|
||
f.m.audit = managementFailAudit{AuditRepository: f.m.audit}
|
||
report, err := f.m.RunRenewal(t.Context(), f.policy, f.now)
|
||
if err == nil || report.Failed != 1 || f.issues != 0 || f.activator.calls != 0 {
|
||
t.Fatalf("审计失败后仍签发：%+v %v", report, err)
|
||
}
|
||
f.assertTask(t, "failed", 0)
|
||
}
|
||
|
||
type managementFailFinish struct {
|
||
repository.TaskRepository
|
||
}
|
||
|
||
func (r managementFailFinish) FinishAttempt(context.Context, string, string, string, *time.Time) error {
|
||
return errors.New("模拟尝试终态写入失败")
|
||
}
|
||
|
||
func TestManagementRenewalReportsPersistenceFailureWithoutAnotherIssue(t *testing.T) {
|
||
f := newManagementFixture(t)
|
||
f.state.NotAfter = f.now.Add(time.Hour)
|
||
f.m.tasks = managementFailFinish{TaskRepository: f.app.Tasks}
|
||
report, err := f.m.RunRenewal(t.Context(), f.policy, f.now)
|
||
if err == nil || report.Succeeded != 0 || report.Failed != 1 || f.issues != 1 || f.activator.calls != 1 {
|
||
t.Fatalf("记录失败被误报为成功或重复签发：%+v %v", report, err)
|
||
}
|
||
items, err := f.app.Tasks.ListTasks(t.Context(), managementResourceID, 10)
|
||
if err != nil || len(items) != 1 || items[0].Status != "failed" || items[0].Stage != "record" {
|
||
t.Fatalf("持久化失败没有失败终态：%+v %v", items, err)
|
||
}
|
||
}
|
||
|
||
func TestApplicationWiresManagementRenewalEvenWithEmptyBusinessList(t *testing.T) {
|
||
cfg := readyApplicationConfig(t)
|
||
a, err := New(t.Context(), cfg)
|
||
if err != nil {
|
||
t.Fatal(err)
|
||
}
|
||
t.Cleanup(func() { _ = a.Close() })
|
||
// 此配置没有管理证书文件，应记录读取失败，不能假装空列表全部成功。
|
||
report, err := a.Renewal.RunOnce(t.Context())
|
||
if err == nil || report.Checked != 1 || report.Failed != 1 {
|
||
t.Fatalf("应用仍未接入管理续期：%+v %v", report, err)
|
||
}
|
||
items, err := a.Tasks.ListTasks(t.Context(), managementResourceID, 10)
|
||
if err != nil || len(items) != 1 || items[0].Status != "failed" {
|
||
t.Fatalf("应用管理续期没有任务：%+v %v", items, err)
|
||
}
|
||
}
|