380 lines
16 KiB
Go
380 lines
16 KiB
Go
package repository
|
|
|
|
import (
|
|
"context"
|
|
"database/sql"
|
|
"encoding/json"
|
|
"errors"
|
|
"path/filepath"
|
|
"sync"
|
|
"testing"
|
|
"time"
|
|
|
|
"git.pcux.cn/xuans/Scert/backend/internal/config"
|
|
"git.pcux.cn/xuans/Scert/backend/internal/database"
|
|
"git.pcux.cn/xuans/Scert/backend/internal/domain"
|
|
"git.pcux.cn/xuans/Scert/backend/internal/testsupport/mysqltest"
|
|
"git.pcux.cn/xuans/Scert/backend/internal/testsupport/postgrestest"
|
|
)
|
|
|
|
type dnsLeaseFixture struct {
|
|
repo *SQLProjectMemberRepository
|
|
db *sql.DB
|
|
driver string
|
|
item domain.Domain
|
|
account domain.DNSAccount
|
|
identity domain.DNSExecutionIdentity
|
|
}
|
|
|
|
func (f dnsLeaseFixture) exec(t *testing.T, query string, args ...any) {
|
|
t.Helper()
|
|
if _, err := f.db.ExecContext(t.Context(), Rebind(f.driver, query), args...); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
}
|
|
|
|
func newDNSLeaseFixture(t *testing.T, db *sql.DB, driver string) dnsLeaseFixture {
|
|
t.Helper()
|
|
repo := NewSQLProjectMemberRepository(db, driver)
|
|
item, err := domain.NewDomain(domain.NewID()+".example.test", domain.CertificateSingle, nil)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
item.ProjectID = domain.NewID()
|
|
if err := NewSQLProjectRepository(db, driver).CreateProject(t.Context(), domain.Project{ID: item.ProjectID, Name: "租约测试"}); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if err := repo.GrantProjectRole(t.Context(), "lease-root", item.ProjectID, "lease-manager", domain.ProjectRoleAdmin); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if err := repo.CreateProjectDomain(t.Context(), "lease-root", item); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
account, err := repo.CreateDNSAccount(t.Context(), "lease-root", domain.DNSAccount{ID: domain.NewID(), Name: "租约账户", ProjectID: item.ProjectID, Provider: "cloudflare", CredentialRef: "secret://dns/" + domain.NewID()})
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
account, err = repo.RecordDNSAccountVerification(t.Context(), "lease-root", account.ID, account.Revision, true)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if _, err := repo.SetDomainDNSAccountBinding(t.Context(), "lease-root", item.ID, account.ID, "", account.Revision); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
item, err = NewSQLDomainRepository(db, driver).GetByID(t.Context(), item.ID)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
identity := domain.DNSExecutionIdentity{TaskID: domain.NewID(), AttemptID: domain.NewID(), AttemptNumber: 1}
|
|
tasks := NewSQLTaskRepository(db, driver)
|
|
if err := tasks.CreateTask(t.Context(), Task{ID: identity.TaskID, DomainID: item.ID, TaskType: "certificate_issue", Status: "running", Stage: "certificate_issue", OperatorID: "lease-manager"}); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if err := tasks.CreateAttempt(t.Context(), TaskAttempt{ID: identity.AttemptID, TaskID: identity.TaskID, AttemptNumber: 1, Status: "running", Stage: "certificate_issue"}); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
return dnsLeaseFixture{repo: repo, db: db, driver: driver, item: item, account: account, identity: identity}
|
|
}
|
|
|
|
func TestDNSExecutionLeaseRepository(t *testing.T) {
|
|
for _, driver := range []string{"sqlite", "mysql", "postgres"} {
|
|
t.Run(driver, func(t *testing.T) {
|
|
cfg := config.Default(t.TempDir()).Database
|
|
cfg.DSN = filepath.Join(t.TempDir(), "dns-leases.db")
|
|
if driver == "mysql" {
|
|
cfg = mysqltest.New(t).Database(t)
|
|
}
|
|
if driver == "postgres" {
|
|
cfg = postgrestest.New(t).Database(t)
|
|
}
|
|
db, err := database.Open(t.Context(), cfg)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
defer db.Close()
|
|
if err := database.Migrate(t.Context(), db.DB, driver); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
for id, role := range map[string]string{"lease-root": "super_admin", "lease-manager": "user"} {
|
|
if _, err := db.DB.ExecContext(t.Context(), Rebind(driver, `INSERT INTO users (id, username, password_hash, role, status) VALUES (?, ?, 'test-only', ?, 'active')`), id, id, role); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
}
|
|
t.Run("lifecycle", func(t *testing.T) {
|
|
f := newDNSLeaseFixture(t, db.DB, driver)
|
|
lease, err := f.repo.AcquireDNSExecutionLease(t.Context(), f.item, f.identity)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if lease.Provider != "cloudflare" || lease.AccountID != f.account.ID || lease.CredentialRef == "" || lease.Revision != f.account.Revision {
|
|
t.Fatal("租约未固定实际账户")
|
|
}
|
|
if err := f.repo.ValidateDNSExecutionLease(t.Context(), lease); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if _, err := f.repo.AcquireDNSExecutionLease(t.Context(), f.item, f.identity); err == nil {
|
|
t.Fatal("重复获取未拒绝")
|
|
}
|
|
for _, mutate := range []func() error{
|
|
func() error {
|
|
_, err := f.repo.RotateDNSAccountCredential(t.Context(), "lease-root", f.account.ID, f.account.Revision, "secret://dns/rotated")
|
|
return err
|
|
},
|
|
func() error {
|
|
_, err := f.repo.SetDNSAccountEnabled(t.Context(), "lease-root", f.account.ID, f.account.Revision, false)
|
|
return err
|
|
},
|
|
func() error {
|
|
_, err := f.repo.SetDomainDNSAccountBinding(t.Context(), "lease-root", f.item.ID, "", f.item.DNSBindingID, 0)
|
|
return err
|
|
},
|
|
func() error { return f.repo.UpdateProjectDomain(t.Context(), "lease-root", f.item) },
|
|
func() error { return NewSQLDomainRepository(db.DB, driver).Update(t.Context(), f.item) },
|
|
func() error { return NewSQLDomainRepository(db.DB, driver).Delete(t.Context(), f.item.ID) },
|
|
} {
|
|
if err := mutate(); !errors.Is(err, ErrDNSAccountBusy) {
|
|
t.Fatal("活动租约未阻止变更", err)
|
|
}
|
|
}
|
|
f.exec(t, `UPDATE tasks SET status = 'failed' WHERE id = ?`, f.identity.TaskID)
|
|
if err := NewSQLDomainRepository(db.DB, driver).UpdateCertificateState(t.Context(), f.item.ID, "failed", nil); err != nil {
|
|
t.Fatal("活动租约不能阻止证书状态更新", err)
|
|
}
|
|
if err := NewSQLDomainRepository(db.DB, driver).Delete(t.Context(), f.item.ID); !errors.Is(err, ErrDNSAccountBusy) {
|
|
t.Fatal("底层删除不能绕过终态任务的遗留租约", err)
|
|
}
|
|
if err := f.repo.DeleteProjectDomain(t.Context(), "lease-root", f.item.ID); !errors.Is(err, ErrDNSAccountBusy) {
|
|
t.Fatal("终态任务仍有租约，不能删除域名", err)
|
|
}
|
|
if err := f.repo.ValidateDNSExecutionLease(t.Context(), lease); err == nil {
|
|
t.Fatal("终态任务仍允许发起 DNS 操作")
|
|
}
|
|
cancelled, cancel := context.WithCancel(t.Context())
|
|
cancel()
|
|
if err := f.repo.ReleaseDNSExecutionLease(cancelled, lease.ID); err == nil {
|
|
t.Fatal("取消的释放应失败")
|
|
}
|
|
if _, err := f.repo.SetDNSAccountEnabled(t.Context(), "lease-root", f.account.ID, f.account.Revision, false); !errors.Is(err, ErrDNSAccountBusy) {
|
|
t.Fatal("释放失败不能丢失引用", err)
|
|
}
|
|
if err := f.repo.ReleaseDNSExecutionLease(t.Context(), lease.ID); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if err := f.repo.ReleaseDNSExecutionLease(t.Context(), lease.ID); err != nil {
|
|
t.Fatal("释放应幂等", err)
|
|
}
|
|
if _, err := f.repo.SetDNSAccountEnabled(t.Context(), "lease-root", f.account.ID, f.account.Revision, false); err != nil {
|
|
t.Fatal("正常释放后应允许禁用", err)
|
|
}
|
|
if err := NewSQLDomainRepository(db.DB, driver).Update(t.Context(), f.item); err != nil {
|
|
t.Fatal("正常释放后应允许资料更新", err)
|
|
}
|
|
if err := NewSQLDomainRepository(db.DB, driver).Delete(t.Context(), f.item.ID); err != nil {
|
|
t.Fatal("正常释放后应允许底层删除", err)
|
|
}
|
|
})
|
|
for _, scenario := range []struct {
|
|
name, column string
|
|
value any
|
|
}{
|
|
{"name", "name", "changed.example.test"},
|
|
{"type", "certificate_type", "san"},
|
|
{"sans", "sans_json", `["other.example.test"]`},
|
|
{"renewal", "auto_renew", false},
|
|
{"environment", "acme_environment", "production"},
|
|
{"provider", "dns_provider", "aliyun"},
|
|
{"challenge", "challenge_type", "http-01"},
|
|
} {
|
|
t.Run("same-timestamp-"+scenario.name, func(t *testing.T) {
|
|
f := newDNSLeaseFixture(t, db.DB, driver)
|
|
f.exec(t, `UPDATE domains SET `+scenario.column+` = ? WHERE id = ?`, scenario.value, f.item.ID)
|
|
if _, err := f.repo.AcquireDNSExecutionLease(t.Context(), f.item, f.identity); !errors.Is(err, ErrDNSExecutionInvalid) {
|
|
t.Fatal("同时间戳的旧配置快照未拒绝", err)
|
|
}
|
|
var count int
|
|
if err := db.DB.QueryRowContext(t.Context(), Rebind(driver, `SELECT COUNT(*) FROM dns_execution_leases WHERE domain_id = ?`), f.item.ID).Scan(&count); err != nil || count != 0 {
|
|
t.Fatal("无效快照遗留执行租约", count, err)
|
|
}
|
|
})
|
|
}
|
|
t.Run("equivalent-sans-encoding", func(t *testing.T) {
|
|
f := newDNSLeaseFixture(t, db.DB, driver)
|
|
encoded, err := json.MarshalIndent(f.item.SANs, "", " ")
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
f.exec(t, `UPDATE domains SET sans_json = ? WHERE id = ?`, string(encoded), f.item.ID)
|
|
lease, err := f.repo.AcquireDNSExecutionLease(t.Context(), f.item, f.identity)
|
|
if err != nil {
|
|
t.Fatal("相同 SAN 不应因 JSON 格式而被拒绝", err)
|
|
}
|
|
if err := f.repo.ReleaseDNSExecutionLease(t.Context(), lease.ID); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
})
|
|
t.Run("atomic-initial-binding", func(t *testing.T) {
|
|
f := newDNSLeaseFixture(t, db.DB, driver)
|
|
for _, scenario := range []string{"success", "old-revision", "wrong-provider", "duplicate-binding", "foreign-project", "http-challenge", "missing-account"} {
|
|
t.Run(scenario, func(t *testing.T) {
|
|
item, err := domain.NewDomain(domain.NewID()+".example.test", domain.CertificateSingle, nil)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
item.ProjectID, item.DNSProvider = f.item.ProjectID, "cloudflare"
|
|
item.DNSAccountID, item.DNSBindingID, item.InitialDNSRevision = f.account.ID, domain.NewID(), f.account.Revision
|
|
switch scenario {
|
|
case "old-revision":
|
|
item.InitialDNSRevision--
|
|
case "wrong-provider":
|
|
item.DNSProvider = "aliyun"
|
|
case "duplicate-binding":
|
|
item.DNSBindingID = f.item.DNSBindingID
|
|
case "foreign-project":
|
|
item.ProjectID = domain.DefaultProjectID
|
|
case "http-challenge":
|
|
item.ChallengeType = domain.ChallengeHTTP01
|
|
case "missing-account":
|
|
item.DNSAccountID = "missing"
|
|
}
|
|
err = f.repo.CreateProjectDomain(t.Context(), "lease-root", item)
|
|
if (err == nil) != (scenario == "success") {
|
|
t.Fatal("原子创建结果不符", err)
|
|
}
|
|
var count int
|
|
if err := db.DB.QueryRowContext(t.Context(), Rebind(driver, `SELECT COUNT(*) FROM domains WHERE id = ?`), item.ID).Scan(&count); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if scenario != "success" && count != 0 {
|
|
t.Fatal("绑定失败遗留未绑定域名")
|
|
}
|
|
if scenario == "success" {
|
|
loaded, err := NewSQLDomainRepository(db.DB, driver).GetByID(t.Context(), item.ID)
|
|
if err != nil || loaded.DNSAccountID != item.DNSAccountID || loaded.DNSBindingID != item.DNSBindingID {
|
|
t.Fatal("创建后绑定不可见", err)
|
|
}
|
|
} else {
|
|
if err := db.DB.QueryRowContext(t.Context(), Rebind(driver, `SELECT COUNT(*) FROM audit_logs WHERE resource_id = ?`), item.ID).Scan(&count); err != nil || count != 0 {
|
|
t.Fatal("失败创建遗留成功审计", err)
|
|
}
|
|
}
|
|
})
|
|
}
|
|
})
|
|
for _, scenario := range []string{"missing-task", "wrong-attempt", "wrong-number", "cancelled-task", "finished-attempt", "wrong-project", "revoked", "anonymous", "fake-scheduler", "disabled", "unverified", "stale-binding", "stale-snapshot", "retry-without-permission"} {
|
|
t.Run(scenario, func(t *testing.T) {
|
|
f := newDNSLeaseFixture(t, db.DB, driver)
|
|
switch scenario {
|
|
case "missing-task":
|
|
f.identity.TaskID = "missing"
|
|
case "wrong-attempt":
|
|
f.identity.AttemptID = "missing"
|
|
case "wrong-number":
|
|
f.identity.AttemptNumber = 2
|
|
case "cancelled-task":
|
|
f.exec(t, `UPDATE tasks SET status = 'cancelling' WHERE id = ?`, f.identity.TaskID)
|
|
case "finished-attempt":
|
|
f.exec(t, `UPDATE task_attempts SET status = 'failed' WHERE id = ?`, f.identity.AttemptID)
|
|
case "wrong-project":
|
|
f.item.ProjectID = domain.DefaultProjectID
|
|
case "revoked":
|
|
f.exec(t, `DELETE FROM project_members WHERE project_id = ?`, f.item.ProjectID)
|
|
case "anonymous":
|
|
f.exec(t, `UPDATE tasks SET operator_id = '' WHERE id = ?`, f.identity.TaskID)
|
|
case "fake-scheduler":
|
|
f.identity.Scheduled = true
|
|
case "disabled":
|
|
_, err = f.repo.SetDNSAccountEnabled(t.Context(), "lease-root", f.account.ID, f.account.Revision, false)
|
|
case "unverified":
|
|
_, err = f.repo.RecordDNSAccountVerification(t.Context(), "lease-root", f.account.ID, f.account.Revision, false)
|
|
case "stale-binding":
|
|
f.item.DNSBindingID = "old-binding"
|
|
case "stale-snapshot":
|
|
f.item.UpdatedAt = f.item.UpdatedAt.Add(-time.Hour)
|
|
case "retry-without-permission":
|
|
f.identity.AttemptNumber = 2
|
|
f.exec(t, `UPDATE task_attempts SET attempt_number = 2 WHERE id = ?`, f.identity.AttemptID)
|
|
f.exec(t, `DELETE FROM project_members WHERE project_id = ?`, f.item.ProjectID)
|
|
}
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if _, err := f.repo.AcquireDNSExecutionLease(t.Context(), f.item, f.identity); err == nil {
|
|
t.Fatal("无效身份或状态获得租约")
|
|
}
|
|
})
|
|
}
|
|
t.Run("scheduled-and-revalidation", func(t *testing.T) {
|
|
f := newDNSLeaseFixture(t, db.DB, driver)
|
|
f.exec(t, `UPDATE tasks SET operator_id = '', task_type = 'renewal_run' WHERE id = ?`, f.identity.TaskID)
|
|
if _, err := f.repo.AcquireDNSExecutionLease(t.Context(), f.item, f.identity); err == nil {
|
|
t.Fatal("空操作者不能隐式成为调度器")
|
|
}
|
|
f.identity.Scheduled = true
|
|
lease, err := f.repo.AcquireDNSExecutionLease(t.Context(), f.item, f.identity)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
forged := lease
|
|
forged.CredentialRef = "secret://dns/other"
|
|
if err := f.repo.ValidateDNSExecutionLease(t.Context(), forged); err == nil {
|
|
t.Fatal("篡改租约未拒绝")
|
|
}
|
|
f.exec(t, `UPDATE domains SET auto_renew = ? WHERE id = ?`, false, f.item.ID)
|
|
if err := f.repo.ValidateDNSExecutionLease(t.Context(), lease); err == nil {
|
|
t.Fatal("关闭续期后仍允许 DNS 写入")
|
|
}
|
|
if err := f.repo.ReleaseDNSExecutionLease(t.Context(), lease.ID); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
})
|
|
t.Run("revocation-after-acquire", func(t *testing.T) {
|
|
f := newDNSLeaseFixture(t, db.DB, driver)
|
|
lease, err := f.repo.AcquireDNSExecutionLease(t.Context(), f.item, f.identity)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
f.exec(t, `DELETE FROM project_members WHERE project_id = ?`, f.item.ProjectID)
|
|
if err := f.repo.ValidateDNSExecutionLease(t.Context(), lease); err == nil {
|
|
t.Fatal("撤权后仍允许 DNS 写入")
|
|
}
|
|
if err := f.repo.ReleaseDNSExecutionLease(t.Context(), lease.ID); err != nil {
|
|
t.Fatal("撤权不应阻止清理收尾", err)
|
|
}
|
|
})
|
|
t.Run("rotation-race", func(t *testing.T) {
|
|
for round := 0; round < 5; round++ {
|
|
f := newDNSLeaseFixture(t, db.DB, driver)
|
|
start := make(chan struct{})
|
|
var wg sync.WaitGroup
|
|
wg.Add(2)
|
|
var lease domain.DNSExecutionLease
|
|
var acquireErr, rotateErr error
|
|
go func() {
|
|
defer wg.Done()
|
|
<-start
|
|
lease, acquireErr = f.repo.AcquireDNSExecutionLease(t.Context(), f.item, f.identity)
|
|
}()
|
|
go func() {
|
|
defer wg.Done()
|
|
<-start
|
|
_, rotateErr = f.repo.RotateDNSAccountCredential(t.Context(), "lease-root", f.account.ID, f.account.Revision, "secret://dns/"+domain.NewID())
|
|
}()
|
|
close(start)
|
|
wg.Wait()
|
|
if acquireErr == nil && rotateErr == nil {
|
|
t.Fatal("获取租约与轮换不能同时成功")
|
|
}
|
|
if acquireErr == nil {
|
|
if err := f.repo.ValidateDNSExecutionLease(t.Context(), lease); err != nil {
|
|
t.Fatal("获胜租约失效", err)
|
|
}
|
|
if err := f.repo.ReleaseDNSExecutionLease(t.Context(), lease.ID); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
}
|
|
}
|
|
})
|
|
})
|
|
}
|
|
}
|