73 lines
2.4 KiB
Go
73 lines
2.4 KiB
Go
package certificate
|
|
|
|
import (
|
|
"bytes"
|
|
"context"
|
|
"os"
|
|
"path/filepath"
|
|
"testing"
|
|
|
|
"github.com/go-acme/lego/v5/challenge"
|
|
)
|
|
|
|
func TestManagementCertificatePreservesReferencedVersions(t *testing.T) {
|
|
cfg := certificateTestConfig(t.TempDir())
|
|
issuer := &serviceIssuer{resource: testResource(t, "management.example.com")}
|
|
service := NewService(cfg, nil, serviceCredentials{}, serviceProviderFactory{}, serviceAccounts{})
|
|
service.acmeRoots = testResourceRoots(t, issuer.resource)
|
|
service.newIssuer = func(*AccountUser, challenge.Provider, string) Issuer { return issuer }
|
|
request := SetupCertificateRequest{
|
|
Domains: []string{"management.example.com"}, CertificateType: "single",
|
|
ProviderID: "cloudflare", CredentialRef: "secret://dns/cloudflare/test",
|
|
AccountEmail: "admin@example.com", Environment: "staging",
|
|
CertificateRoot: cfg.Paths.Certificate, BackupRoot: cfg.Paths.Backup,
|
|
}
|
|
first, err := service.IssueForSetup(t.Context(), request)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
original := make(map[string][]byte)
|
|
for _, name := range []string{"cert.pem", "fullchain.pem", "key.pem", "metadata.json"} {
|
|
data, err := os.ReadFile(filepath.Join(first.Directory, name))
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
original[name] = data
|
|
}
|
|
// 使用不同证书证明后续申请及失败回退不会覆盖旧版本内容。
|
|
issuer.resource = testResource(t, "management.example.com")
|
|
service.acmeRoots = testResourceRoots(t, issuer.resource)
|
|
second, err := service.IssueForSetup(t.Context(), request)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if second.Directory == first.Directory || second.BackupDirectory == "" {
|
|
t.Fatal("管理证书候选必须保存到新版本并备份旧版本")
|
|
}
|
|
assertUnchanged := func() {
|
|
t.Helper()
|
|
for name, expected := range original {
|
|
actual, err := os.ReadFile(filepath.Join(first.Directory, name))
|
|
if err != nil || !bytes.Equal(actual, expected) {
|
|
t.Fatalf("仍被引用的管理证书文件被修改：%s %v", name, err)
|
|
}
|
|
}
|
|
}
|
|
assertUnchanged()
|
|
if err := RollbackSavedResource(context.Background(), second); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
assertUnchanged()
|
|
third, err := service.IssueForSetup(t.Context(), request)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if third.Directory == second.Directory || third.Directory == first.Directory {
|
|
t.Fatal("后续申请不得复用既有管理证书版本")
|
|
}
|
|
assertUnchanged()
|
|
if _, err := os.Stat(second.FullChainPath); err != nil {
|
|
t.Fatalf("失败候选应保留用于审查：%v", err)
|
|
}
|
|
}
|