123 lines
5.0 KiB
Go
123 lines
5.0 KiB
Go
package certificate
|
||
|
||
import (
|
||
"context"
|
||
"errors"
|
||
"os"
|
||
"strings"
|
||
"testing"
|
||
|
||
"github.com/go-acme/lego/v5/challenge"
|
||
|
||
"git.pcux.cn/xuans/Scert/backend/internal/domain"
|
||
)
|
||
|
||
type scopedAuthorizationChecker struct {
|
||
denied string
|
||
calls []string
|
||
}
|
||
|
||
type scopedServiceCredentials struct{}
|
||
|
||
func (scopedServiceCredentials) Get(context.Context, string) (map[string]string, error) {
|
||
return map[string]string{"access_key_id": "test-id", "access_key_secret": "test-secret", "managed_zones": "example.com,example.org", "allowed_domains": "example.com,other.example.org"}, nil
|
||
}
|
||
|
||
func (c *scopedAuthorizationChecker) VerifyDomain(_ context.Context, _ string, name string, _ map[string]string) error {
|
||
c.calls = append(c.calls, name)
|
||
if name == c.denied {
|
||
return errors.New("Forbidden.NoPermission")
|
||
}
|
||
return nil
|
||
}
|
||
|
||
func TestServiceRejectsUnauthorizedSANBeforeIssuerOrFileWrites(t *testing.T) {
|
||
for _, denied := range []string{"example.com", "other.example.org"} {
|
||
t.Run(denied, func(t *testing.T) {
|
||
cfg := certificateTestConfig(t.TempDir())
|
||
cfg.DNS.Provider = "aliyun"
|
||
item, err := domain.NewDomainWithOptions("example.com", domain.CertificateSAN, []string{"other.example.org"}, false, "staging", "aliyun")
|
||
if err != nil {
|
||
t.Fatal(err)
|
||
}
|
||
provider := &recordingProviderFactory{}
|
||
repo := &serviceRepository{item: item}
|
||
checker := &scopedAuthorizationChecker{denied: denied}
|
||
service := NewService(cfg, repo, scopedServiceCredentials{}, provider, serviceAccounts{})
|
||
service.SetDNSAuthorizationChecker(checker)
|
||
service.newIssuer = func(*AccountUser, challenge.Provider, string) Issuer {
|
||
t.Fatal("任意 SAN 权限拒绝后不得创建 ACME 签发器")
|
||
return nil
|
||
}
|
||
_, err = service.Issue(t.Context(), item.ID)
|
||
if err == nil || !strings.Contains(err.Error(), denied) || !strings.Contains(err.Error(), "Forbidden.NoPermission") {
|
||
t.Fatalf("必须拒绝并指出无权限的 SAN：%v", err)
|
||
}
|
||
if provider.providerID != "" {
|
||
t.Fatal("权限拒绝后不得创建 DNS 挑战 Provider")
|
||
}
|
||
if repo.item.Status != "failed" {
|
||
t.Fatalf("失败状态未保存：%s", repo.item.Status)
|
||
}
|
||
if _, err := os.Stat(cfg.Paths.Certificate); !errors.Is(err, os.ErrNotExist) {
|
||
t.Fatal("权限拒绝后不得写入证书文件")
|
||
}
|
||
})
|
||
}
|
||
}
|
||
|
||
func TestSetupRejectsUnauthorizedDomainBeforeIssuer(t *testing.T) {
|
||
cfg := certificateTestConfig(t.TempDir())
|
||
service := NewService(cfg, nil, scopedServiceCredentials{}, serviceProviderFactory{}, serviceAccounts{})
|
||
service.SetDNSAuthorizationChecker(&scopedAuthorizationChecker{denied: "other.example.org"})
|
||
service.newIssuer = func(*AccountUser, challenge.Provider, string) Issuer {
|
||
t.Fatal("初始化证书中的未授权域名必须在 ACME 请求前拒绝")
|
||
return nil
|
||
}
|
||
_, err := service.IssueForSetup(t.Context(), SetupCertificateRequest{
|
||
Domains: []string{"example.com", "other.example.org"}, CertificateType: "san",
|
||
ProviderID: "aliyun", CredentialRef: "secret://dns/test", Environment: "staging",
|
||
CertificateRoot: cfg.Paths.Certificate, BackupRoot: cfg.Paths.Backup,
|
||
})
|
||
if err == nil || !strings.Contains(err.Error(), "other.example.org") {
|
||
t.Fatalf("初始化证书申请未拒绝未授权域名：%v", err)
|
||
}
|
||
}
|
||
|
||
func TestAliyunMissingAuthorizationCheckerBlocksIssueAndSetup(t *testing.T) {
|
||
cfg := certificateTestConfig(t.TempDir())
|
||
cfg.DNS.Provider = "aliyun"
|
||
item, err := domain.NewDomainWithOptions("example.com", domain.CertificateSingle, nil, false, "staging", "aliyun")
|
||
if err != nil {
|
||
t.Fatal(err)
|
||
}
|
||
provider := &recordingProviderFactory{}
|
||
service := NewService(cfg, &serviceRepository{item: item}, scopedServiceCredentials{}, provider, serviceAccounts{})
|
||
if _, err := service.Issue(t.Context(), item.ID); err == nil || !strings.Contains(err.Error(), "探测器未初始化") {
|
||
t.Fatalf("缺失检查器必须阻止签发：%v", err)
|
||
}
|
||
if _, err := service.IssueForSetup(t.Context(), SetupCertificateRequest{
|
||
Domains: []string{"example.com"}, CertificateType: "single", ProviderID: "aliyun",
|
||
CredentialRef: cfg.DNS.CredentialRef, Environment: "staging",
|
||
}); err == nil || !strings.Contains(err.Error(), "探测器未初始化") {
|
||
t.Fatalf("缺失检查器必须阻止初始化证书签发：%v", err)
|
||
}
|
||
if provider.providerID != "" {
|
||
t.Fatal("缺失检查器时不得创建 DNS 挑战 Provider")
|
||
}
|
||
}
|
||
|
||
func TestAliyunWholeOrderScopeValidationBeforeAnyCloudProbe(t *testing.T) {
|
||
cfg := certificateTestConfig(t.TempDir())
|
||
checker := &scopedAuthorizationChecker{}
|
||
service := NewService(cfg, nil, scopedServiceCredentials{}, serviceProviderFactory{}, serviceAccounts{})
|
||
service.SetDNSAuthorizationChecker(checker)
|
||
_, err := service.IssueForSetup(t.Context(), SetupCertificateRequest{
|
||
Domains: []string{"example.com", "outside.net"}, CertificateType: "san",
|
||
ProviderID: "aliyun", CredentialRef: "secret://dns/test", Environment: "staging",
|
||
})
|
||
if err == nil || !strings.Contains(err.Error(), "outside.net") || len(checker.calls) != 0 {
|
||
t.Fatalf("部分越界必须零云调用拒绝整单：%v %v", err, checker.calls)
|
||
}
|
||
}
|