1package publictls
2
3import (
4 "context"
5 "testing"
6
7 "github.com/stretchr/testify/assert"
8 "github.com/stretchr/testify/mock"
9 "github.com/stretchr/testify/require"
10
11 "github.com/bnema/gordon/internal/boundaries/out"
12 outmocks "github.com/bnema/gordon/internal/boundaries/out/mocks"
13 "github.com/bnema/gordon/internal/domain"
14)
15
16func TestDeriveTargets_HTTP01PerRoute(t *testing.T) {
17 hosts := []out.AppHost{{Host: "app.example.com"}, {Host: "registry.example.com"}}
18 targets, err := DeriveCertificateTargets(context.Background(), domain.ACMEChallengeHTTP01, hosts, nil, nil, nil)
19 require.NoError(t, err)
20 require.Len(t, targets, 2)
21
22 assert.Equal(t, "http01-app.example.com", targets[0].ID)
23 assert.Equal(t, []string{"app.example.com"}, targets[0].Names)
24 assert.Equal(t, domain.ACMEChallengeHTTP01, targets[0].Challenge)
25 assert.Equal(t, "http01-registry.example.com", targets[1].ID)
26 assert.Equal(t, []string{"registry.example.com"}, targets[1].Names)
27 assert.Equal(t, domain.ACMEChallengeHTTP01, targets[1].Challenge)
28}
29
30func TestDeriveTargets_DNS01WildcardBases(t *testing.T) {
31 hosts := []out.AppHost{{Host: "app.example.com"}, {Host: "api.prod.example.com"}, {Host: "example.com"}}
32 resolver := outmocks.NewMockCloudflareZoneResolver(t)
33 resolver.EXPECT().FindZone(mock.Anything, mock.Anything).Return(out.CloudflareZone{Name: "example.com"}, nil).Times(3)
34 targets, err := DeriveCertificateTargets(context.Background(), domain.ACMEChallengeCloudflareDNS01, hosts, nil, nil, resolver)
35 require.NoError(t, err)
36 require.Len(t, targets, 2)
37
38 assert.Equal(t, "dns01-example.com", targets[0].ID)
39 assert.Equal(t, []string{"example.com", "*.example.com"}, targets[0].Names)
40 assert.Equal(t, domain.ACMEChallengeCloudflareDNS01, targets[0].Challenge)
41 assert.Equal(t, "dns01-prod.example.com", targets[1].ID)
42 assert.Equal(t, []string{"prod.example.com", "*.prod.example.com"}, targets[1].Names)
43 assert.Equal(t, domain.ACMEChallengeCloudflareDNS01, targets[1].Challenge)
44}
45
46func TestDeriveTargets_IncludesAdditionalHosts(t *testing.T) {
47 targets, err := DeriveCertificateTargets(
48 context.Background(),
49 domain.ACMEChallengeHTTP01,
50 nil,
51 nil,
52 []string{"gordon.example.com"},
53 nil,
54 )
55 require.NoError(t, err)
56 require.Len(t, targets, 1)
57 assert.Equal(t, "http01-gordon.example.com", targets[0].ID)
58 assert.Equal(t, []string{"gordon.example.com"}, targets[0].Names)
59}
60
61func TestDeriveTargets_IncludesExternalRoutes(t *testing.T) {
62 hosts := []out.AppHost{{Host: "app.example.com"}}
63 external := map[string]string{"external.example.com": "127.0.0.1:8080"}
64 targets, err := DeriveCertificateTargets(context.Background(), domain.ACMEChallengeHTTP01, hosts, external, nil, nil)
65 require.NoError(t, err)
66 require.Len(t, targets, 2)
67
68 assert.Equal(t, "http01-app.example.com", targets[0].ID)
69 assert.Equal(t, "http01-external.example.com", targets[1].ID)
70 assert.Equal(t, []string{"external.example.com"}, targets[1].Names)
71}
72
73func TestDeriveTargets_SkipsNeverTLSHosts(t *testing.T) {
74 hosts := []out.AppHost{
75 {Host: "plain.example.com", TLSMode: "never"},
76 {Host: "app.example.com", TLSMode: "auto"},
77 }
78 targets, err := DeriveCertificateTargets(context.Background(), domain.ACMEChallengeHTTP01, hosts, nil, nil, nil)
79 require.NoError(t, err)
80 require.Len(t, targets, 1, "tls=never hosts stay plain HTTP: no certificate target")
81 assert.Equal(t, "http01-app.example.com", targets[0].ID)
82 assert.Equal(t, []string{"app.example.com"}, targets[0].Names)
83}
84
85func TestDeriveTargets_DNS01NilResolver_ReturnsError(t *testing.T) {
86 hosts := []out.AppHost{{Host: "app.example.com"}}
87 _, err := DeriveCertificateTargets(context.Background(), domain.ACMEChallengeCloudflareDNS01, hosts, nil, nil, nil)
88 require.Error(t, err)
89 assert.Contains(t, err.Error(), "resolver is nil")
90}
91
92func TestDeriveTargets_DNS01MismatchedZone_ReturnsError(t *testing.T) {
93 hosts := []out.AppHost{{Host: "app.example.com"}}
94 resolver := outmocks.NewMockCloudflareZoneResolver(t)
95 resolver.EXPECT().FindZone(mock.Anything, mock.Anything).Return(out.CloudflareZone{Name: "other.test"}, nil).Once()
96 _, err := DeriveCertificateTargets(context.Background(), domain.ACMEChallengeCloudflareDNS01, hosts, nil, nil, resolver)
97 require.Error(t, err)
98 assert.Contains(t, err.Error(), "does not match host")
99}
100
101func TestDeriveTargets_DuplicateCanonicalization(t *testing.T) {
102 hosts := []out.AppHost{{Host: "App.Example.Com"}, {Host: "app.example.com"}}
103 targets, err := DeriveCertificateTargets(context.Background(), domain.ACMEChallengeHTTP01, hosts, nil, nil, nil)
104 require.NoError(t, err)
105 require.Len(t, targets, 1, "mixed-case duplicates should collapse to one target")
106 assert.Equal(t, "http01-app.example.com", targets[0].ID)
107 assert.Equal(t, []string{"app.example.com"}, targets[0].Names)
108}