From df96b126dc46804b0af4c18e34dd7ef98de79005 Mon Sep 17 00:00:00 2001 From: Mariano Cano Date: Wed, 24 Aug 2022 12:31:09 -0700 Subject: [PATCH] Add AuthorizeChallenge unit tests --- acme/api/order_test.go | 88 ++++++++++++++++++++++++++++-- authority/provisioner/acme_test.go | 41 ++++++++++++++ 2 files changed, 125 insertions(+), 4 deletions(-) diff --git a/acme/api/order_test.go b/acme/api/order_test.go index 6ce330c0..0875b7ec 100644 --- a/acme/api/order_test.go +++ b/acme/api/order_test.go @@ -500,10 +500,12 @@ func TestHandler_GetOrder(t *testing.T) { } func TestHandler_newAuthorization(t *testing.T) { + defaultProvisioner := newProv() type test struct { - az *acme.Authorization - db acme.DB - err *acme.Error + az *acme.Authorization + prov acme.Provisioner + db acme.DB + err *acme.Error } var tests = map[string]func(t *testing.T) test{ "fail/error-db.CreateChallenge": func(t *testing.T) test { @@ -515,6 +517,7 @@ func TestHandler_newAuthorization(t *testing.T) { }, } return test{ + prov: defaultProvisioner, db: &acme.MockDB{ MockCreateChallenge: func(ctx context.Context, ch *acme.Challenge) error { assert.Equals(t, ch.AccountID, az.AccountID) @@ -542,6 +545,7 @@ func TestHandler_newAuthorization(t *testing.T) { count := 0 var ch1, ch2, ch3 **acme.Challenge return test{ + prov: defaultProvisioner, db: &acme.MockDB{ MockCreateChallenge: func(ctx context.Context, ch *acme.Challenge) error { switch count { @@ -596,6 +600,7 @@ func TestHandler_newAuthorization(t *testing.T) { count := 0 var ch1, ch2, ch3 **acme.Challenge return test{ + prov: defaultProvisioner, db: &acme.MockDB{ MockCreateChallenge: func(ctx context.Context, ch *acme.Challenge) error { switch count { @@ -648,6 +653,7 @@ func TestHandler_newAuthorization(t *testing.T) { } var ch1 **acme.Challenge return test{ + prov: defaultProvisioner, db: &acme.MockDB{ MockCreateChallenge: func(ctx context.Context, ch *acme.Challenge) error { ch.ID = "dns" @@ -676,12 +682,86 @@ func TestHandler_newAuthorization(t *testing.T) { az: az, } }, + "ok/permanent-identifier-disabled": func(t *testing.T) test { + az := &acme.Authorization{ + AccountID: "accID", + Identifier: acme.Identifier{ + Type: "permanent-identifier", + Value: "7b53aa19-26f7-4fac-824f-7a781de0dab0", + }, + Status: acme.StatusPending, + ExpiresAt: clock.Now(), + } + return test{ + prov: defaultProvisioner, + db: &acme.MockDB{ + MockCreateChallenge: func(ctx context.Context, ch *acme.Challenge) error { + t.Errorf("createChallenge should not be called") + return nil + }, + MockCreateAuthorization: func(ctx context.Context, _az *acme.Authorization) error { + assert.Equals(t, _az.AccountID, az.AccountID) + assert.Equals(t, _az.Token, az.Token) + assert.Equals(t, _az.Status, acme.StatusPending) + assert.Equals(t, _az.Identifier, az.Identifier) + assert.Equals(t, _az.ExpiresAt, az.ExpiresAt) + assert.Equals(t, _az.Challenges, []*acme.Challenge{}) + assert.Equals(t, _az.Wildcard, false) + return nil + }, + }, + az: az, + } + }, + "ok/permanent-identifier-enabled": func(t *testing.T) test { + var ch1 *acme.Challenge + az := &acme.Authorization{ + AccountID: "accID", + Identifier: acme.Identifier{ + Type: "permanent-identifier", + Value: "7b53aa19-26f7-4fac-824f-7a781de0dab0", + }, + Status: acme.StatusPending, + ExpiresAt: clock.Now(), + } + deviceAttestProv := newProv() + deviceAttestProv.(*provisioner.ACME).Challenges = []string{string(acme.DEVICEATTEST01)} + return test{ + prov: deviceAttestProv, + db: &acme.MockDB{ + MockCreateChallenge: func(ctx context.Context, ch *acme.Challenge) error { + ch.ID = "997bacc2-c175-4214-a3b4-a229ada5f671" + assert.Equals(t, ch.Type, acme.DEVICEATTEST01) + assert.Equals(t, ch.AccountID, az.AccountID) + assert.Equals(t, ch.Token, az.Token) + assert.Equals(t, ch.Status, acme.StatusPending) + assert.Equals(t, ch.Value, "7b53aa19-26f7-4fac-824f-7a781de0dab0") + ch1 = ch + return nil + }, + MockCreateAuthorization: func(ctx context.Context, _az *acme.Authorization) error { + assert.Equals(t, _az.AccountID, az.AccountID) + assert.Equals(t, _az.Token, az.Token) + assert.Equals(t, _az.Status, acme.StatusPending) + assert.Equals(t, _az.Identifier, az.Identifier) + assert.Equals(t, _az.ExpiresAt, az.ExpiresAt) + assert.Equals(t, _az.Challenges, []*acme.Challenge{ch1}) + assert.Equals(t, _az.Wildcard, false) + return nil + }, + }, + az: az, + } + }, } for name, run := range tests { t.Run(name, func(t *testing.T) { + if name == "ok/permanent-identifier-enabled" { + println(1) + } tc := run(t) ctx := newBaseContext(context.Background(), tc.db) - ctx = acme.NewProvisionerContext(ctx, newProv()) + ctx = acme.NewProvisionerContext(ctx, tc.prov) if err := newAuthorization(ctx, tc.az); err != nil { if assert.NotNil(t, tc.err) { switch k := err.(type) { diff --git a/authority/provisioner/acme_test.go b/authority/provisioner/acme_test.go index 33cbbc75..8f48e37e 100644 --- a/authority/provisioner/acme_test.go +++ b/authority/provisioner/acme_test.go @@ -204,3 +204,44 @@ func TestACME_AuthorizeSign(t *testing.T) { }) } } + +func TestACME_AuthorizeChallenge(t *testing.T) { + ctx := context.Background() + type fields struct { + Challenges []string + } + type args struct { + ctx context.Context + challenge string + } + tests := []struct { + name string + fields fields + args args + wantErr bool + }{ + {"ok http-01", fields{nil}, args{ctx, "http-01"}, false}, + {"ok dns-01", fields{nil}, args{ctx, "dns-01"}, false}, + {"ok tls-alpn-01", fields{[]string{}}, args{ctx, "tls-alpn-01"}, false}, + {"fail device-attest-01", fields{[]string{}}, args{ctx, "device-attest-01"}, true}, + {"ok http-01 enabled", fields{[]string{"http-01"}}, args{ctx, "http-01"}, false}, + {"ok dns-01 enabled", fields{[]string{"http-01", "dns-01"}}, args{ctx, "dns-01"}, false}, + {"ok tls-alpn-01 enabled", fields{[]string{"http-01", "dns-01", "tls-alpn-01"}}, args{ctx, "tls-alpn-01"}, false}, + {"ok device-attest-01 enabled", fields{[]string{"device-attest-01", "dns-01"}}, args{ctx, "device-attest-01"}, false}, + {"fail http-01", fields{[]string{"dns-01"}}, args{ctx, "http-01"}, true}, + {"fail dns-01", fields{[]string{"http-01", "tls-alpn-01"}}, args{ctx, "dns-01"}, true}, + {"fail tls-alpn-01", fields{[]string{"http-01", "dns-01", "device-attest-01"}}, args{ctx, "tls-alpn-01"}, true}, + {"fail device-attest-01", fields{[]string{"http-01", "dns-01"}}, args{ctx, "device-attest-01"}, true}, + {"fail unknown", fields{[]string{"http-01", "dns-01", "tls-alpn-01", "device-attest-01"}}, args{ctx, "unknown"}, true}, + } + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + p := &ACME{ + Challenges: tt.fields.Challenges, + } + if err := p.AuthorizeChallenge(tt.args.ctx, tt.args.challenge); (err != nil) != tt.wantErr { + t.Errorf("ACME.AuthorizeChallenge() error = %v, wantErr %v", err, tt.wantErr) + } + }) + } +}