1package admin
2
3import (
4 "encoding/json"
5 "net/http"
6 "testing"
7 "time"
8
9 "github.com/stretchr/testify/assert"
10 "github.com/stretchr/testify/require"
11
12 "github.com/bnema/gordon/internal/adapters/dto"
13 inmocks "github.com/bnema/gordon/internal/boundaries/in/mocks"
14)
15
16func TestHandler_CA(t *testing.T) {
17 expiry := time.Date(2027, 1, 2, 3, 4, 5, 0, time.UTC)
18 caSvc := inmocks.NewMockCAInfoService(t)
19 caSvc.EXPECT().RootCommonName().Return("Gordon Root")
20 caSvc.EXPECT().RootFingerprint().Return("AB:CD")
21 caSvc.EXPECT().IntermediateExpiresAt().Return(expiry)
22 caSvc.EXPECT().RootCertificate().Return([]byte("-----BEGIN CERTIFICATE-----\nx\n-----END CERTIFICATE-----\n"))
23 handler := newTestHandler(t, func(d *HandlerDeps) { d.CASvc = caSvc })
24 server := newScopedTestServer(t, handler, "admin:status:read")
25
26 resp, err := http.Get(server.URL + "/admin/ca")
27 require.NoError(t, err)
28 defer resp.Body.Close()
29 require.Equal(t, http.StatusOK, resp.StatusCode)
30
31 var body dto.CAResponse
32 require.NoError(t, json.NewDecoder(resp.Body).Decode(&body))
33 assert.Equal(t, "Gordon Root", body.RootCN)
34 assert.Equal(t, "AB:CD", body.Fingerprint)
35 assert.True(t, expiry.Equal(body.IntermediateExpiry))
36 assert.Contains(t, body.RootPEM, "BEGIN CERTIFICATE")
37}
38
39func TestHandler_CARequiresStatusRead(t *testing.T) {
40 caSvc := inmocks.NewMockCAInfoService(t)
41 handler := newTestHandler(t, func(d *HandlerDeps) { d.CASvc = caSvc })
42 server := newScopedTestServer(t, handler, "admin:config:read")
43
44 resp, err := http.Get(server.URL + "/admin/ca")
45 require.NoError(t, err)
46 defer resp.Body.Close()
47 assert.Equal(t, http.StatusForbidden, resp.StatusCode)
48}
49
50func TestHandler_CARejectsNonGet(t *testing.T) {
51 handler := newTestHandler(t, func(d *HandlerDeps) { d.CASvc = inmocks.NewMockCAInfoService(t) })
52 server := newScopedTestServer(t, handler, "admin:status:read")
53
54 resp, err := http.Post(server.URL+"/admin/ca", "application/json", nil)
55 require.NoError(t, err)
56 defer resp.Body.Close()
57 assert.Equal(t, http.StatusMethodNotAllowed, resp.StatusCode)
58}
59
60func TestHandler_CADisabledReturnsNotFound(t *testing.T) {
61 handler := newTestHandler(t, func(d *HandlerDeps) { d.CASvc = nil })
62 server := newScopedTestServer(t, handler, "admin:status:read")
63
64 resp, err := http.Get(server.URL + "/admin/ca")
65 require.NoError(t, err)
66 defer resp.Body.Close()
67 require.Equal(t, http.StatusNotFound, resp.StatusCode)
68
69 var body dto.ErrorResponse
70 require.NoError(t, json.NewDecoder(resp.Body).Decode(&body))
71 assert.Contains(t, body.Error, "internal TLS is disabled")
72}