378 lines
16 KiB
Go
378 lines
16 KiB
Go
package app
|
||
|
||
import (
|
||
"context"
|
||
"errors"
|
||
"strings"
|
||
"testing"
|
||
"time"
|
||
|
||
"git.pcux.cn/xuans/Scert/backend/internal/certificate"
|
||
"git.pcux.cn/xuans/Scert/backend/internal/deployment"
|
||
"git.pcux.cn/xuans/Scert/backend/internal/domain"
|
||
)
|
||
|
||
type workflowCertificateService struct {
|
||
result certificate.IssueResult
|
||
called bool
|
||
}
|
||
|
||
func (s *workflowCertificateService) Issue(context.Context, string) (certificate.IssueResult, error) {
|
||
s.called = true
|
||
return s.result, nil
|
||
}
|
||
|
||
func (s *workflowCertificateService) Import(context.Context, certificate.ImportRequest) (certificate.IssueResult, error) {
|
||
s.called = true
|
||
return s.result, nil
|
||
}
|
||
|
||
type workflowServerLister struct {
|
||
servers []deployment.Server
|
||
err error
|
||
}
|
||
|
||
func (s workflowServerLister) ListDeploymentServersByDomainID(context.Context, string) ([]deployment.Server, error) {
|
||
return s.servers, s.err
|
||
}
|
||
|
||
func TestCertificateWorkflowStopsBeforeRemoteWriteOnSharedPathConflict(t *testing.T) {
|
||
deployer := &workflowDeployer{}
|
||
workflow := &CertificateWorkflow{
|
||
Domains: &workflowDomainState{},
|
||
Servers: workflowServerLister{err: deployment.ErrSharedPathConflict},
|
||
Deployment: deployer,
|
||
}
|
||
_, err := workflow.deploy(t.Context(), certificate.IssueResult{DomainID: "shared-domain"})
|
||
if !errors.Is(err, deployment.ErrSharedPathConflict) || deployer.targets != nil {
|
||
t.Fatalf("路径冲突后仍尝试远端部署：%v，%+v", err, deployer.targets)
|
||
}
|
||
}
|
||
|
||
type workflowDeployer struct {
|
||
targets []deployment.Target
|
||
files deployment.SavedFiles
|
||
report deployment.Report
|
||
}
|
||
|
||
type workflowDomainState struct {
|
||
id string
|
||
status string
|
||
expiresAt *time.Time
|
||
updateErr error
|
||
updateCalled int
|
||
item domain.Domain
|
||
}
|
||
|
||
func (s *workflowDomainState) GetByID(_ context.Context, id string) (domain.Domain, error) {
|
||
item := s.item
|
||
if item.ID == "" {
|
||
item.ID = id
|
||
}
|
||
if item.Name == "" {
|
||
item.Name = "example.com"
|
||
}
|
||
if item.CertificateType == "" {
|
||
item.CertificateType = domain.CertificateSingle
|
||
}
|
||
return item, nil
|
||
}
|
||
|
||
func (s *workflowDomainState) UpdateCertificateState(_ context.Context, id, status string, expiresAt *time.Time) error {
|
||
s.updateCalled++
|
||
if s.updateErr != nil {
|
||
return s.updateErr
|
||
}
|
||
s.id, s.status = id, status
|
||
if expiresAt != nil {
|
||
value := *expiresAt
|
||
s.expiresAt = &value
|
||
}
|
||
return nil
|
||
}
|
||
|
||
func (d *workflowDeployer) DeploySaved(_ context.Context, targets []deployment.Target, files deployment.SavedFiles) (deployment.Report, error) {
|
||
d.targets = targets
|
||
d.files = files
|
||
return d.report, nil
|
||
}
|
||
|
||
// 工作流替身只模拟推送和校验，不伪造远端事务恢复；恢复边界由部署包实测。
|
||
func (d *workflowDeployer) DeploySavedVerified(ctx context.Context, targets []deployment.Target, files deployment.SavedFiles, verification deployment.Verification) (deployment.Report, error) {
|
||
report, err := d.DeploySaved(ctx, targets, files)
|
||
if err != nil || report.Status != "success" {
|
||
return report, err
|
||
}
|
||
report.VerificationStatus = "failed"
|
||
if err := verification.Verify(ctx); err != nil {
|
||
report.Status = "failed"
|
||
return report, err
|
||
}
|
||
report.VerificationStatus = "success"
|
||
return report, nil
|
||
}
|
||
|
||
func TestCertificateWorkflowDeploysIssuedCertificateToAssociatedServers(t *testing.T) {
|
||
certificateService := &workflowCertificateService{result: certificate.IssueResult{
|
||
DomainID: "domain-1",
|
||
Saved: certificate.SavedResource{CertificatePath: "cert.pem", FullChainPath: "fullchain.pem", PrivateKeyPath: "key.pem"},
|
||
}}
|
||
deployer := &workflowDeployer{report: deployment.Report{Total: 1, Success: 1, Status: "success"}}
|
||
state := &workflowDomainState{item: domain.Domain{ID: "domain-1", Name: "example.com", CertificateType: domain.CertificateSingle}}
|
||
workflow := &CertificateWorkflow{
|
||
Certificates: certificateService,
|
||
Domains: state,
|
||
Servers: workflowServerLister{servers: []deployment.Server{{ID: "server-1", Name: "生产服务器"}}},
|
||
Deployment: deployer,
|
||
}
|
||
result, err := workflow.IssueWithReport(context.Background(), "domain-1")
|
||
if err != nil {
|
||
t.Fatalf("证书工作流失败：%v", err)
|
||
}
|
||
if !certificateService.called || result.Deployment.Status != "success" || len(deployer.targets) != 1 {
|
||
t.Fatalf("证书工作流结果错误：%+v %+v", result, deployer.targets)
|
||
}
|
||
if deployer.files.PrivateKeyPath != "key.pem" {
|
||
t.Fatalf("部署文件路径错误：%+v", deployer.files)
|
||
}
|
||
if deployer.targets[0].Server.CertificatePath != "/ssl/example.com/single/cert.pem" || deployer.targets[0].Server.PrivateKeyPath != "/ssl/example.com/single/key.pem" {
|
||
t.Fatalf("部署目标路径未按域名和证书类型解析：%+v", deployer.targets[0].Server)
|
||
}
|
||
}
|
||
|
||
func TestCertificateWorkflowRejectsDomainWithoutDeploymentServers(t *testing.T) {
|
||
deployer := &workflowDeployer{report: deployment.Report{Total: 1, Success: 1, Status: "success"}}
|
||
state := &workflowDomainState{item: domain.Domain{ID: "domain-1", Name: "example.com", CertificateType: domain.CertificateSingle}}
|
||
workflow := &CertificateWorkflow{
|
||
Domains: state,
|
||
Servers: workflowServerLister{},
|
||
Deployment: deployer,
|
||
}
|
||
|
||
report, err := workflow.deploy(context.Background(), certificate.IssueResult{DomainID: "domain-1"})
|
||
if err == nil || !strings.Contains(err.Error(), "\u5c1a\u672a\u5173\u8054\u4efb\u4f55\u90e8\u7f72\u670d\u52a1\u5668") {
|
||
t.Fatalf("\u672a\u5173\u8054\u670d\u52a1\u5668\u65f6\u5e94\u8fd4\u56de\u660e\u786e\u9519\u8bef\xef\xbc\x9a%v", err)
|
||
}
|
||
if report.Status != "failed" || deployer.targets != nil {
|
||
t.Fatalf("\u672a\u5173\u8054\u670d\u52a1\u5668\u65f6\u4e0d\u5f97\u6267\u884c\u8fdc\u7a0b\u90e8\u7f72\xef\xbc\x9a%+v %+v", report, deployer.targets)
|
||
}
|
||
}
|
||
|
||
func TestCertificateWorkflowReturnsPartialDeploymentError(t *testing.T) {
|
||
deployer := &workflowDeployer{report: deployment.Report{
|
||
Total: 2, Success: 1, Failed: 1, Status: "partial",
|
||
Results: []deployment.Result{
|
||
{ServerID: "server-1", Server: "primary", Status: "success", Message: "deployed"},
|
||
{ServerID: "server-2", Server: "secondary", Status: "failed", Message: "validation failed"},
|
||
},
|
||
}}
|
||
state := &workflowDomainState{item: domain.Domain{ID: "domain-1", Name: "*.example.com", CertificateType: domain.CertificateWildcard}}
|
||
workflow := &CertificateWorkflow{
|
||
Certificates: &workflowCertificateService{result: certificate.IssueResult{DomainID: "domain-1"}},
|
||
Domains: state,
|
||
Servers: workflowServerLister{servers: []deployment.Server{{ID: "server-1"}, {ID: "server-2"}}},
|
||
Deployment: deployer,
|
||
}
|
||
result, err := workflow.IssueWithReport(context.Background(), "domain-1")
|
||
if err == nil || result.Deployment.Status != "partial" {
|
||
t.Fatalf("部分部署应返回错误和报告：%+v %v", result, err)
|
||
}
|
||
if !strings.Contains(err.Error(), "secondary: validation failed") || strings.Contains(err.Error(), "primary: deployed") {
|
||
t.Fatalf("deployment error details are incomplete: %v", err)
|
||
}
|
||
if result.Certificate.DomainID != "domain-1" {
|
||
t.Fatalf("证书结果未保留：%+v", result.Certificate)
|
||
}
|
||
if state.id != "domain-1" || state.status != "error" {
|
||
t.Fatalf("部署失败后域名状态未标记为错误：%+v", state)
|
||
}
|
||
}
|
||
|
||
func TestCertificateWorkflowResolvesSameServerForDifferentDomains(t *testing.T) {
|
||
server := deployment.Server{ID: "server-1", Name: "共享服务器"}
|
||
deployer := &workflowDeployer{report: deployment.Report{Total: 1, Success: 1, Status: "success"}}
|
||
state := &workflowDomainState{item: domain.Domain{ID: "domain-1", Name: "example.com", CertificateType: domain.CertificateSAN}}
|
||
workflow := &CertificateWorkflow{
|
||
Certificates: &workflowCertificateService{result: certificate.IssueResult{DomainID: "domain-1"}},
|
||
Domains: state,
|
||
Servers: workflowServerLister{servers: []deployment.Server{server}},
|
||
Deployment: deployer,
|
||
}
|
||
if _, err := workflow.IssueWithReport(context.Background(), "domain-1"); err != nil {
|
||
t.Fatalf("第一个域名部署失败：%v", err)
|
||
}
|
||
firstPath := deployer.targets[0].Server.CertificatePath
|
||
state.item = domain.Domain{ID: "domain-2", Name: "api.example.net", CertificateType: domain.CertificateSingle}
|
||
workflow.Certificates = &workflowCertificateService{result: certificate.IssueResult{DomainID: "domain-2"}}
|
||
if _, err := workflow.IssueWithReport(context.Background(), "domain-2"); err != nil {
|
||
t.Fatalf("第二个域名部署失败：%v", err)
|
||
}
|
||
secondPath := deployer.targets[0].Server.CertificatePath
|
||
if firstPath != "/ssl/example.com/san/cert.pem" || secondPath != "/ssl/api.example.net/single/cert.pem" || firstPath == secondPath {
|
||
t.Fatalf("共享服务器的域名部署路径发生覆盖：%s %s", firstPath, secondPath)
|
||
}
|
||
}
|
||
|
||
func TestCertificateWorkflowRetriesRemoteVerificationUntilSuccess(t *testing.T) {
|
||
saved := workflowSavedCertificate(t)
|
||
deployer := &workflowDeployer{report: deployment.Report{Total: 1, Success: 1, Status: "success"}}
|
||
state := &workflowDomainState{item: domain.Domain{ID: "domain-1", Name: "example.com", CertificateType: domain.CertificateSingle}}
|
||
verificationCalls := 0
|
||
waitCalls := 0
|
||
workflow := &CertificateWorkflow{
|
||
Certificates: &workflowCertificateService{result: certificate.IssueResult{DomainID: "domain-1", Domains: []string{"example.com"}, Saved: saved}},
|
||
Domains: state,
|
||
Servers: workflowServerLister{servers: []deployment.Server{{ID: "server-1"}}},
|
||
Deployment: deployer,
|
||
RemoteVerificationAttempts: 4,
|
||
RemoteVerificationInterval: 10 * time.Millisecond,
|
||
RemoteVerificationWait: func(ctx context.Context, interval time.Duration) error {
|
||
waitCalls++
|
||
if interval != 10*time.Millisecond {
|
||
t.Fatalf("HTTPS 校验重试间隔错误：%s", interval)
|
||
}
|
||
return ctx.Err()
|
||
},
|
||
RemoteVerifier: func(_ context.Context, endpoint string, expectedDomains []string) (certificate.ValidationResult, error) {
|
||
verificationCalls++
|
||
if endpoint != "https://example.com" || len(expectedDomains) != 1 || expectedDomains[0] != "example.com" {
|
||
t.Fatalf("HTTPS 校验参数错误：%s %+v", endpoint, expectedDomains)
|
||
}
|
||
if verificationCalls < 4 {
|
||
return certificate.ValidationResult{}, errors.New("仍返回旧证书")
|
||
}
|
||
return certificate.ValidationResult{FingerprintSHA256: saved.FingerprintSHA256}, nil
|
||
},
|
||
}
|
||
|
||
if _, err := workflow.IssueWithReport(context.Background(), "domain-1"); err != nil {
|
||
t.Fatalf("HTTPS 校验重试后应成功：%v", err)
|
||
}
|
||
if verificationCalls != 4 || waitCalls != 2 {
|
||
t.Fatalf("HTTPS 校验重试次数错误：校验 %d 次，等待 %d 次", verificationCalls, waitCalls)
|
||
}
|
||
}
|
||
|
||
func TestCertificateWorkflowRemoteVerificationStopsAfterConfiguredAttempts(t *testing.T) {
|
||
saved := workflowSavedCertificate(t)
|
||
deployer := &workflowDeployer{report: deployment.Report{Total: 1, Success: 1, Status: "success"}}
|
||
state := &workflowDomainState{item: domain.Domain{ID: "domain-1", Name: "example.com", CertificateType: domain.CertificateSingle}}
|
||
verificationCalls := 0
|
||
waitCalls := 0
|
||
workflow := &CertificateWorkflow{
|
||
Certificates: &workflowCertificateService{result: certificate.IssueResult{DomainID: "domain-1", Domains: []string{"example.com"}, Saved: saved}},
|
||
Domains: state,
|
||
Servers: workflowServerLister{servers: []deployment.Server{{ID: "server-1"}}},
|
||
Deployment: deployer,
|
||
RemoteVerificationAttempts: 3,
|
||
RemoteVerificationWait: func(context.Context, time.Duration) error {
|
||
waitCalls++
|
||
return nil
|
||
},
|
||
RemoteVerifier: func(context.Context, string, []string) (certificate.ValidationResult, error) {
|
||
verificationCalls++
|
||
return certificate.ValidationResult{}, errors.New("证书永久不匹配")
|
||
},
|
||
}
|
||
|
||
_, err := workflow.IssueWithReport(context.Background(), "domain-1")
|
||
if err == nil || !strings.Contains(err.Error(), "重试 3 次后仍未通过") {
|
||
t.Fatalf("永久校验错误应在有限重试后返回：%v", err)
|
||
}
|
||
if verificationCalls != 4 || waitCalls != 2 {
|
||
t.Fatalf("永久错误的重试次数错误：校验 %d 次，等待 %d 次", verificationCalls, waitCalls)
|
||
}
|
||
}
|
||
|
||
func TestCertificateWorkflowRemoteVerificationWaitHonorsContextCancellation(t *testing.T) {
|
||
saved := workflowSavedCertificate(t)
|
||
deployer := &workflowDeployer{report: deployment.Report{Total: 1, Success: 1, Status: "success"}}
|
||
state := &workflowDomainState{item: domain.Domain{ID: "domain-1", Name: "example.com", CertificateType: domain.CertificateSingle}}
|
||
ctx, cancel := context.WithCancel(context.Background())
|
||
verificationCalls := 0
|
||
workflow := &CertificateWorkflow{
|
||
Certificates: &workflowCertificateService{result: certificate.IssueResult{DomainID: "domain-1", Domains: []string{"example.com"}, Saved: saved}},
|
||
Domains: state,
|
||
Servers: workflowServerLister{servers: []deployment.Server{{ID: "server-1"}}},
|
||
Deployment: deployer,
|
||
RemoteVerificationAttempts: 6,
|
||
RemoteVerificationInterval: time.Minute,
|
||
RemoteVerifier: func(context.Context, string, []string) (certificate.ValidationResult, error) {
|
||
verificationCalls++
|
||
if verificationCalls == 1 {
|
||
return certificate.ValidationResult{FingerprintSHA256: saved.FingerprintSHA256}, nil
|
||
}
|
||
cancel()
|
||
return certificate.ValidationResult{}, errors.New("等待新证书")
|
||
},
|
||
}
|
||
|
||
_, err := workflow.IssueWithReport(ctx, "domain-1")
|
||
if !errors.Is(err, context.Canceled) {
|
||
t.Fatalf("取消上下文后应立即终止 HTTPS 校验重试：%v", err)
|
||
}
|
||
if verificationCalls != 2 {
|
||
t.Fatalf("取消后不应继续校验，实际调用 %d 次", verificationCalls)
|
||
}
|
||
}
|
||
|
||
func TestCertificateWorkflowDeployCurrentRestoresValidState(t *testing.T) {
|
||
notAfter := time.Now().UTC().Add(30 * 24 * time.Hour).Truncate(time.Second)
|
||
saved := workflowSavedCertificate(t)
|
||
saved.NotAfter = notAfter
|
||
state := &workflowDomainState{
|
||
status: "error",
|
||
item: domain.Domain{ID: "domain-1", Name: "example.com", CertificateType: domain.CertificateSingle},
|
||
}
|
||
workflow := &CertificateWorkflow{
|
||
CurrentCertificate: func(context.Context, string) (certificate.IssueResult, error) {
|
||
return certificate.IssueResult{
|
||
DomainID: "domain-1",
|
||
Domains: []string{"example.com"},
|
||
Saved: saved,
|
||
}, nil
|
||
},
|
||
Domains: state,
|
||
Servers: workflowServerLister{servers: []deployment.Server{{ID: "server-1"}}},
|
||
Deployment: &workflowDeployer{report: deployment.Report{Total: 1, Success: 1, Status: "success"}},
|
||
RemoteVerifier: func(context.Context, string, []string) (certificate.ValidationResult, error) {
|
||
return certificate.ValidationResult{FingerprintSHA256: saved.FingerprintSHA256}, nil
|
||
},
|
||
}
|
||
|
||
result, err := workflow.DeployCurrent(context.Background(), "domain-1")
|
||
if err != nil {
|
||
t.Fatalf("当前证书重新部署应成功：%v", err)
|
||
}
|
||
if result.Deployment.Status != "success" || state.id != "domain-1" || state.status != "valid" || state.updateCalled != 1 {
|
||
t.Fatalf("成功部署后域名状态未恢复：%+v %+v", result.Deployment, state)
|
||
}
|
||
if state.expiresAt == nil || !state.expiresAt.Equal(notAfter) {
|
||
t.Fatalf("成功部署后证书到期时间未更新：%v", state.expiresAt)
|
||
}
|
||
}
|
||
|
||
func TestCertificateWorkflowDeployCurrentReturnsStateUpdateError(t *testing.T) {
|
||
state := &workflowDomainState{
|
||
status: "error",
|
||
updateErr: errors.New("数据库不可写"),
|
||
item: domain.Domain{ID: "domain-1", Name: "example.com", CertificateType: domain.CertificateSingle},
|
||
}
|
||
workflow := &CertificateWorkflow{
|
||
CurrentCertificate: func(context.Context, string) (certificate.IssueResult, error) {
|
||
return certificate.IssueResult{DomainID: "domain-1"}, nil
|
||
},
|
||
Domains: state,
|
||
Servers: workflowServerLister{servers: []deployment.Server{{ID: "server-1"}}},
|
||
Deployment: &workflowDeployer{report: deployment.Report{Total: 1, Success: 1, Status: "success"}},
|
||
}
|
||
|
||
result, err := workflow.DeployCurrent(context.Background(), "domain-1")
|
||
if err == nil || !strings.Contains(err.Error(), "更新域名证书状态失败") {
|
||
t.Fatalf("域名状态更新失败时应返回明确错误：%v", err)
|
||
}
|
||
if result.Deployment.Status != "success" || state.updateCalled != 1 || state.status != "error" {
|
||
t.Fatalf("状态更新失败时应保留部署报告和原状态，且不能静默忽略：%+v %+v", result.Deployment, state)
|
||
}
|
||
}
|