1package publictls
2
3import (
4 "context"
5 "testing"
6
7 "github.com/stretchr/testify/assert"
8 "github.com/stretchr/testify/mock"
9 "github.com/stretchr/testify/require"
10
11 "github.com/bnema/gordon/internal/boundaries/out"
12 outmocks "github.com/bnema/gordon/internal/boundaries/out/mocks"
13 "github.com/bnema/gordon/internal/domain"
14)
15
16func TestDeriveTargets_HTTP01PerRoute(t *testing.T) {
17 routes := []domain.Route{{Domain: "app.example.com"}, {Domain: "registry.example.com"}}
18 targets, err := DeriveCertificateTargets(context.Background(), domain.ACMEChallengeHTTP01, routes, nil, nil)
19 require.NoError(t, err)
20 require.Len(t, targets, 2)
21
22 assert.Equal(t, "http01-app.example.com", targets[0].ID)
23 assert.Equal(t, []string{"app.example.com"}, targets[0].Names)
24 assert.Equal(t, domain.ACMEChallengeHTTP01, targets[0].Challenge)
25 assert.Equal(t, "http01-registry.example.com", targets[1].ID)
26 assert.Equal(t, []string{"registry.example.com"}, targets[1].Names)
27 assert.Equal(t, domain.ACMEChallengeHTTP01, targets[1].Challenge)
28}
29
30func TestDeriveTargets_DNS01WildcardBases(t *testing.T) {
31 routes := []domain.Route{{Domain: "app.example.com"}, {Domain: "api.prod.example.com"}, {Domain: "example.com"}}
32 resolver := outmocks.NewMockCloudflareZoneResolver(t)
33 resolver.EXPECT().FindZone(mock.Anything, mock.Anything).Return(out.CloudflareZone{Name: "example.com"}, nil).Times(3)
34 targets, err := DeriveCertificateTargets(context.Background(), domain.ACMEChallengeCloudflareDNS01, routes, nil, resolver)
35 require.NoError(t, err)
36 require.Len(t, targets, 2)
37
38 assert.Equal(t, "dns01-example.com", targets[0].ID)
39 assert.Equal(t, []string{"example.com", "*.example.com"}, targets[0].Names)
40 assert.Equal(t, domain.ACMEChallengeCloudflareDNS01, targets[0].Challenge)
41 assert.Equal(t, "dns01-prod.example.com", targets[1].ID)
42 assert.Equal(t, []string{"prod.example.com", "*.prod.example.com"}, targets[1].Names)
43 assert.Equal(t, domain.ACMEChallengeCloudflareDNS01, targets[1].Challenge)
44}
45
46func TestDeriveTargets_IncludesExternalRoutes(t *testing.T) {
47 routes := []domain.Route{{Domain: "app.example.com"}}
48 external := map[string]string{"external.example.com": "127.0.0.1:8080"}
49 targets, err := DeriveCertificateTargets(context.Background(), domain.ACMEChallengeHTTP01, routes, external, nil)
50 require.NoError(t, err)
51 require.Len(t, targets, 2)
52
53 assert.Equal(t, "http01-app.example.com", targets[0].ID)
54 assert.Equal(t, "http01-external.example.com", targets[1].ID)
55 assert.Equal(t, []string{"external.example.com"}, targets[1].Names)
56}
57
58func TestDeriveTargets_DNS01NilResolver_ReturnsError(t *testing.T) {
59 routes := []domain.Route{{Domain: "app.example.com"}}
60 _, err := DeriveCertificateTargets(context.Background(), domain.ACMEChallengeCloudflareDNS01, routes, nil, nil)
61 require.Error(t, err)
62 assert.Contains(t, err.Error(), "resolver is nil")
63}
64
65func TestDeriveTargets_DNS01MismatchedZone_ReturnsError(t *testing.T) {
66 routes := []domain.Route{{Domain: "app.example.com"}}
67 resolver := outmocks.NewMockCloudflareZoneResolver(t)
68 resolver.EXPECT().FindZone(mock.Anything, mock.Anything).Return(out.CloudflareZone{Name: "other.test"}, nil).Once()
69 _, err := DeriveCertificateTargets(context.Background(), domain.ACMEChallengeCloudflareDNS01, routes, nil, resolver)
70 require.Error(t, err)
71 assert.Contains(t, err.Error(), "does not match host")
72}
73
74func TestDeriveTargets_DuplicateCanonicalization(t *testing.T) {
75 routes := []domain.Route{{Domain: "App.Example.Com"}, {Domain: "app.example.com"}}
76 targets, err := DeriveCertificateTargets(context.Background(), domain.ACMEChallengeHTTP01, routes, nil, nil)
77 require.NoError(t, err)
78 require.Len(t, targets, 1, "mixed-case duplicates should collapse to one target")
79 assert.Equal(t, "http01-app.example.com", targets[0].ID)
80 assert.Equal(t, []string{"app.example.com"}, targets[0].Names)
81}