1package pki_test
2
3import (
4 "context"
5 "crypto/tls"
6 "testing"
7
8 "github.com/bnema/zerowrap"
9 "github.com/stretchr/testify/assert"
10 "github.com/stretchr/testify/mock"
11 "github.com/stretchr/testify/require"
12
13 pkiadapter "github.com/bnema/gordon/internal/adapters/out/pki"
14 "github.com/bnema/gordon/internal/boundaries/out/mocks"
15 "github.com/bnema/gordon/internal/domain"
16 pkiusecase "github.com/bnema/gordon/internal/usecase/pki"
17)
18
19func testLogger() zerowrap.Logger { return zerowrap.Default() }
20
21func newRouteCheckerMock(t *testing.T, domains ...string) *mocks.MockRouteChecker {
22 m := mocks.NewMockRouteChecker(t)
23 routes := make([]domain.Route, len(domains))
24 for i, d := range domains {
25 routes[i] = domain.Route{Domain: d}
26 }
27 m.EXPECT().GetRoutes(mock.Anything).Return(routes).Maybe()
28 m.EXPECT().GetExternalRoutes().Return(nil).Maybe()
29 return m
30}
31
32func TestService_GetCertificate_KnownDomain(t *testing.T) {
33 dir := t.TempDir()
34 ca, err := pkiadapter.NewCA(dir, testLogger())
35 require.NoError(t, err)
36
37 cfg := newRouteCheckerMock(t, "app.example.com")
38
39 ctx, cancel := context.WithCancel(context.Background())
40 defer cancel()
41
42 svc := pkiusecase.NewService(ctx, ca, cfg, testLogger())
43 defer svc.Stop()
44
45 hello := &tls.ClientHelloInfo{ServerName: "app.example.com"}
46 cert, err := svc.GetCertificate(hello)
47 require.NoError(t, err)
48 require.NotNil(t, cert)
49}
50
51func TestService_GetCertificate_UnknownDomain(t *testing.T) {
52 dir := t.TempDir()
53 ca, err := pkiadapter.NewCA(dir, testLogger())
54 require.NoError(t, err)
55
56 cfg := newRouteCheckerMock(t, "app.example.com")
57
58 ctx, cancel := context.WithCancel(context.Background())
59 defer cancel()
60
61 svc := pkiusecase.NewService(ctx, ca, cfg, testLogger())
62 defer svc.Stop()
63
64 hello := &tls.ClientHelloInfo{ServerName: "unknown.example.com"}
65 cert, err := svc.GetCertificate(hello)
66 assert.NoError(t, err)
67 assert.Nil(t, cert)
68}
69
70func TestService_GetCertificate_Caching(t *testing.T) {
71 dir := t.TempDir()
72 ca, err := pkiadapter.NewCA(dir, testLogger())
73 require.NoError(t, err)
74
75 cfg := newRouteCheckerMock(t, "cached.example.com")
76
77 ctx, cancel := context.WithCancel(context.Background())
78 defer cancel()
79
80 svc := pkiusecase.NewService(ctx, ca, cfg, testLogger())
81 defer svc.Stop()
82
83 hello := &tls.ClientHelloInfo{ServerName: "cached.example.com"}
84 cert1, err := svc.GetCertificate(hello)
85 require.NoError(t, err)
86
87 cert2, err := svc.GetCertificate(hello)
88 require.NoError(t, err)
89
90 // Same pointer = served from cache
91 assert.Same(t, cert1, cert2, "second call should return cached cert")
92}