From 0b5f6487e14d5b68ca8aebc18747beb900c30230 Mon Sep 17 00:00:00 2001 From: max furman Date: Thu, 11 Oct 2018 23:03:00 -0700 Subject: [PATCH] change provisioners api * /provisioners -> /provisioners/jwk-set-by-issuer * /provisioners now returns a list of Provisioners --- api/api.go | 34 ++++++++++- api/api_test.go | 104 +++++++++++++++++++++++++++++--- authority/authority_test.go | 3 +- authority/authorize.go | 3 +- authority/config.go | 34 ++--------- authority/config_test.go | 57 ++--------------- authority/provisioners.go | 25 +------- authority/provisioners_test.go | 18 +----- authority/tls.go | 18 +++--- ca/ca_test.go | 53 +++++++++++++++- ca/client_test.go | 63 ++++++++++++++++++- provisioner/provisioner.go | 31 ++++++++++ provisioner/provisioner_test.go | 55 +++++++++++++++++ 13 files changed, 354 insertions(+), 144 deletions(-) create mode 100644 provisioner/provisioner.go create mode 100644 provisioner/provisioner_test.go diff --git a/api/api.go b/api/api.go index 090acb62..6c8b2810 100644 --- a/api/api.go +++ b/api/api.go @@ -11,6 +11,7 @@ import ( "github.com/go-chi/chi" "github.com/pkg/errors" + "github.com/smallstep/ca-component/provisioner" "github.com/smallstep/cli/crypto/tlsutil" "github.com/smallstep/cli/crypto/x509util" "github.com/smallstep/cli/jose" @@ -46,7 +47,7 @@ type Authority interface { Root(shasum string) (*x509.Certificate, error) Sign(cr *x509.CertificateRequest, opts SignOptions, claims ...Claim) (*x509.Certificate, *x509.Certificate, error) Renew(cert *x509.Certificate) (*x509.Certificate, *x509.Certificate, error) - GetProvisioners() (map[string]*jose.JSONWebKeySet, error) + GetProvisioners() ([]*provisioner.Provisioner, error) GetEncryptedKey(kid string) (string, error) } @@ -172,10 +173,16 @@ type SignRequest struct { NotBefore time.Time `json:"notBefore"` } -// ProvisionersResponse is the response object that returns the map of +// ProvisionersResponse is the response object that returns the list of // provisioners. type ProvisionersResponse struct { - Provisioners map[string]*jose.JSONWebKeySet `json:"provisioners"` + Provisioners []*provisioner.Provisioner `json:"provisioners"` +} + +// JWKSetByIssuerResponse is the response object that returns the map of +// provisioners. +type JWKSetByIssuerResponse struct { + Map map[string]*jose.JSONWebKeySet `json:"map"` } // ProvisionerKeyResponse is the response object that returns the encryptoed key @@ -250,6 +257,7 @@ func (h *caHandler) Route(r Router) { r.MethodFunc("POST", "/renew", h.Renew) r.MethodFunc("GET", "/provisioners", h.Provisioners) r.MethodFunc("GET", "/provisioners/{kid}/encrypted-key", h.ProvisionerKey) + r.MethodFunc("GET", "/provisioners/jwk-set-by-issuer", h.JWKSetByIssuer) } // Health is an HTTP handler that returns the status of the server. @@ -353,3 +361,23 @@ func (h *caHandler) ProvisionerKey(w http.ResponseWriter, r *http.Request) { } JSON(w, &ProvisionerKeyResponse{key}) } + +func (h *caHandler) JWKSetByIssuer(w http.ResponseWriter, r *http.Request) { + m := map[string]*jose.JSONWebKeySet{} + ps, err := h.Authority.GetProvisioners() + if err != nil { + WriteError(w, InternalServerError(err)) + return + } + for _, p := range ps { + ks, found := m[p.Issuer] + if found { + ks.Keys = append(ks.Keys, *p.Key) + } else { + ks = new(jose.JSONWebKeySet) + ks.Keys = []jose.JSONWebKey{*p.Key} + m[p.Issuer] = ks + } + } + JSON(w, &JWKSetByIssuerResponse{m}) +} diff --git a/api/api_test.go b/api/api_test.go index 1c02e6da..93fa8748 100644 --- a/api/api_test.go +++ b/api/api_test.go @@ -17,6 +17,7 @@ import ( "time" "github.com/go-chi/chi" + "github.com/smallstep/ca-component/provisioner" "github.com/smallstep/cli/crypto/tlsutil" "github.com/smallstep/cli/jose" ) @@ -397,7 +398,7 @@ type mockAuthority struct { root func(shasum string) (*x509.Certificate, error) sign func(cr *x509.CertificateRequest, opts SignOptions, claims ...Claim) (*x509.Certificate, *x509.Certificate, error) renew func(cert *x509.Certificate) (*x509.Certificate, *x509.Certificate, error) - getProvisioners func() (map[string]*jose.JSONWebKeySet, error) + getProvisioners func() ([]*provisioner.Provisioner, error) getEncryptedKey func(kid string) (string, error) } @@ -444,11 +445,11 @@ func (m *mockAuthority) Renew(cert *x509.Certificate) (*x509.Certificate, *x509. return m.ret1.(*x509.Certificate), m.ret2.(*x509.Certificate), m.err } -func (m *mockAuthority) GetProvisioners() (map[string]*jose.JSONWebKeySet, error) { +func (m *mockAuthority) GetProvisioners() ([]*provisioner.Provisioner, error) { if m.getProvisioners != nil { return m.getProvisioners() } - return m.ret1.(map[string]*jose.JSONWebKeySet), m.err + return m.ret1.([]*provisioner.Provisioner), m.err } func (m *mockAuthority) GetEncryptedKey(kid string) (string, error) { @@ -670,6 +671,82 @@ func Test_caHandler_Renew(t *testing.T) { } } +func Test_caHandler_JWKSetByIssuer(t *testing.T) { + type fields struct { + Authority Authority + } + type args struct { + w http.ResponseWriter + r *http.Request + } + + req, err := http.NewRequest("GET", "http://example.com/provisioners/jwk-set-by-issuer", nil) + if err != nil { + t.Fatal(err) + } + + var key jose.JSONWebKey + if err := json.Unmarshal([]byte(pubKey), &key); err != nil { + t.Fatal(err) + } + + p := []*provisioner.Provisioner{ + &provisioner.Provisioner{ + Issuer: "p1", + Key: &key, + }, + &provisioner.Provisioner{ + Issuer: "p2", + Key: &key, + }, + } + + tests := []struct { + name string + fields fields + args args + statusCode int + }{ + {"ok", fields{&mockAuthority{ret1: p}}, args{httptest.NewRecorder(), req}, 200}, + {"fail", fields{&mockAuthority{ret1: p, err: fmt.Errorf("the error")}}, args{httptest.NewRecorder(), req}, 500}, + } + + expectedKey, err := json.Marshal(key) + if err != nil { + t.Fatal(err) + } + expected := []byte(`{"map":{"p1":{"keys":[` + string(expectedKey) + `]},"p2":{"keys":[` + string(expectedKey) + `]}}}`) + expectedError := []byte(`{"status":500,"message":"Internal Server Error"}`) + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + h := &caHandler{ + Authority: tt.fields.Authority, + } + h.JWKSetByIssuer(tt.args.w, tt.args.r) + + rec := tt.args.w.(*httptest.ResponseRecorder) + res := rec.Result() + if res.StatusCode != tt.statusCode { + t.Errorf("caHandler.JWKSetByIssuer StatusCode = %d, wants %d", res.StatusCode, tt.statusCode) + } + body, err := ioutil.ReadAll(res.Body) + res.Body.Close() + if err != nil { + t.Errorf("caHandler.JWKSetByIssuer unexpected error = %v", err) + } + if tt.statusCode < http.StatusBadRequest { + if !bytes.Equal(bytes.TrimSpace(body), expected) { + t.Errorf("caHandler.JWKSetByIssuer Body = %s, wants %s", body, expected) + } + } else { + if !bytes.Equal(bytes.TrimSpace(body), expectedError) { + t.Errorf("caHandler.JWKSetByIssuer Body = %s, wants %s", body, expectedError) + } + } + }) + } +} + func Test_caHandler_Provisioners(t *testing.T) { type fields struct { Authority Authority @@ -689,14 +766,21 @@ func Test_caHandler_Provisioners(t *testing.T) { t.Fatal(err) } - p := map[string]*jose.JSONWebKeySet{ - "p1": &jose.JSONWebKeySet{ - Keys: []jose.JSONWebKey{key}, + p := []*provisioner.Provisioner{ + &provisioner.Provisioner{ + Type: "JWK", + Issuer: "max", + EncryptedKey: "abc", + Key: &key, }, - "p2": &jose.JSONWebKeySet{ - Keys: []jose.JSONWebKey{key}, + &provisioner.Provisioner{ + Type: "JWK", + Issuer: "mariano", + EncryptedKey: "def", + Key: &key, }, } + pr := ProvisionersResponse{p} tests := []struct { name string @@ -708,11 +792,11 @@ func Test_caHandler_Provisioners(t *testing.T) { {"fail", fields{&mockAuthority{ret1: p, err: fmt.Errorf("the error")}}, args{httptest.NewRecorder(), req}, 500}, } - expectedKey, err := json.Marshal(key) + expected, err := json.Marshal(pr) if err != nil { t.Fatal(err) } - expected := []byte(`{"provisioners":{"p1":{"keys":[` + string(expectedKey) + `]},"p2":{"keys":[` + string(expectedKey) + `]}}}`) + expectedError := []byte(`{"status":500,"message":"Internal Server Error"}`) for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { diff --git a/authority/authority_test.go b/authority/authority_test.go index ca26025a..b57108b6 100644 --- a/authority/authority_test.go +++ b/authority/authority_test.go @@ -7,6 +7,7 @@ import ( "github.com/pkg/errors" "github.com/smallstep/assert" + "github.com/smallstep/ca-component/provisioner" stepJOSE "github.com/smallstep/cli/jose" ) @@ -15,7 +16,7 @@ func testAuthority(t *testing.T) *Authority { assert.FatalError(t, err) clijwk, err := stepJOSE.ParseKey("testdata/secrets/step_cli_key_pub.jwk") assert.FatalError(t, err) - p := []*Provisioner{ + p := []*provisioner.Provisioner{ { Issuer: "Max", Type: "JWK", diff --git a/authority/authorize.go b/authority/authorize.go index cec5800f..ba98e2cb 100644 --- a/authority/authorize.go +++ b/authority/authorize.go @@ -6,6 +6,7 @@ import ( "github.com/pkg/errors" "github.com/smallstep/ca-component/api" + "github.com/smallstep/ca-component/provisioner" "gopkg.in/square/go-jose.v2/jwt" ) @@ -63,7 +64,7 @@ func (a *Authority) Authorize(ott string) ([]api.Claim, error) { return nil, &apiError{errors.Errorf("Provisioner with KeyID %s could not be found", kid), http.StatusUnauthorized, errContext} } - p, ok := val.(*Provisioner) + p, ok := val.(*provisioner.Provisioner) if !ok { return nil, &apiError{errors.Errorf("stored value is not a *Provisioner"), http.StatusInternalServerError, context{}} diff --git a/authority/config.go b/authority/config.go index 4abdd9a0..37e9f478 100644 --- a/authority/config.go +++ b/authority/config.go @@ -6,9 +6,9 @@ import ( "time" "github.com/pkg/errors" + "github.com/smallstep/ca-component/provisioner" "github.com/smallstep/cli/crypto/tlsutil" "github.com/smallstep/cli/crypto/x509util" - jose "gopkg.in/square/go-jose.v2" ) // DefaultTLSOptions represents the default TLS version as well as the cipher @@ -51,30 +51,6 @@ func (d *duration) UnmarshalJSON(data []byte) (err error) { return } -// Provisioner - authorized entity that can sign tokens necessary for signature requests. -type Provisioner struct { - Issuer string `json:"issuer,omitempty"` - Type string `json:"type,omitempty"` - Key *jose.JSONWebKey `json:"key,omitempty"` - EncryptedKey string `json:"encryptedKey,omitempty"` -} - -// Validate validates a provisioner. -func (p *Provisioner) Validate() error { - switch { - case p.Issuer == "": - return errors.New("provisioner issuer cannot be empty") - - case p.Type == "": - return errors.New("provisioner type cannot be empty") - - case p.Key == nil: - return errors.New("provisioner key cannot be empty") - } - - return nil -} - // Config represents the CA configuration and it's mapped to a JSON object. type Config struct { Root string `json:"root"` @@ -91,10 +67,10 @@ type Config struct { // AuthConfig represents the configuration options for the authority. type AuthConfig struct { - Provisioners []*Provisioner `json:"provisioners,omitempty"` - Template *x509util.ASN1DN `json:"template,omitempty"` - MinCertDuration *duration `json:"minCertDuration,omitempty"` - MaxCertDuration *duration `json:"maxCertDuration,omitempty"` + Provisioners []*provisioner.Provisioner `json:"provisioners,omitempty"` + Template *x509util.ASN1DN `json:"template,omitempty"` + MinCertDuration *duration `json:"minCertDuration,omitempty"` + MaxCertDuration *duration `json:"maxCertDuration,omitempty"` } // Validate validates the authority configuration. diff --git a/authority/config_test.go b/authority/config_test.go index 64315fac..05ee450f 100644 --- a/authority/config_test.go +++ b/authority/config_test.go @@ -5,65 +5,20 @@ import ( "github.com/pkg/errors" "github.com/smallstep/assert" + "github.com/smallstep/ca-component/provisioner" "github.com/smallstep/cli/crypto/tlsutil" "github.com/smallstep/cli/crypto/x509util" stepJOSE "github.com/smallstep/cli/jose" jose "gopkg.in/square/go-jose.v2" ) -func TestProvisionerValidate(t *testing.T) { - type ProvisionerValidateTest struct { - p *Provisioner - err error - } - tests := map[string]func(*testing.T) ProvisionerValidateTest{ - "fail-empty-issuer": func(t *testing.T) ProvisionerValidateTest { - return ProvisionerValidateTest{ - p: &Provisioner{}, - err: errors.New("provisioner issuer cannot be empty"), - } - }, - "fail-empty-type": func(t *testing.T) ProvisionerValidateTest { - return ProvisionerValidateTest{ - p: &Provisioner{Issuer: "foo"}, - err: errors.New("provisioner type cannot be empty"), - } - }, - "fail-empty-key": func(t *testing.T) ProvisionerValidateTest { - return ProvisionerValidateTest{ - p: &Provisioner{Issuer: "foo", Type: "bar"}, - err: errors.New("provisioner key cannot be empty"), - } - }, - "ok": func(t *testing.T) ProvisionerValidateTest { - return ProvisionerValidateTest{ - p: &Provisioner{Issuer: "foo", Type: "bar", Key: &jose.JSONWebKey{}}, - } - }, - } - - for name, get := range tests { - t.Run(name, func(t *testing.T) { - tc := get(t) - err := tc.p.Validate() - if err != nil { - if assert.NotNil(t, tc.err) { - assert.Equals(t, tc.err.Error(), err.Error()) - } - } else { - assert.Nil(t, tc.err) - } - }) - } -} - func TestConfigValidate(t *testing.T) { maxjwk, err := stepJOSE.ParseKey("testdata/secrets/max_pub.jwk") assert.FatalError(t, err) clijwk, err := stepJOSE.ParseKey("testdata/secrets/step_cli_key_pub.jwk") assert.FatalError(t, err) ac := &AuthConfig{ - Provisioners: []*Provisioner{ + Provisioners: []*provisioner.Provisioner{ { Issuer: "Max", Type: "JWK", @@ -261,7 +216,7 @@ func TestAuthConfigValidate(t *testing.T) { assert.FatalError(t, err) clijwk, err := stepJOSE.ParseKey("testdata/secrets/step_cli_key_pub.jwk") assert.FatalError(t, err) - p := []*Provisioner{ + p := []*provisioner.Provisioner{ { Issuer: "Max", Type: "JWK", @@ -295,9 +250,9 @@ func TestAuthConfigValidate(t *testing.T) { "fail-invalid-provisioners": func(t *testing.T) AuthConfigValidateTest { return AuthConfigValidateTest{ ac: &AuthConfig{ - Provisioners: []*Provisioner{ - &Provisioner{Issuer: "foo", Type: "bar", Key: &jose.JSONWebKey{}}, - &Provisioner{Issuer: "foo", Key: &jose.JSONWebKey{}}, + Provisioners: []*provisioner.Provisioner{ + {Issuer: "foo", Type: "bar", Key: &jose.JSONWebKey{}}, + {Issuer: "foo", Key: &jose.JSONWebKey{}}, }, }, err: errors.New("provisioner type cannot be empty"), diff --git a/authority/provisioners.go b/authority/provisioners.go index 3e609700..cfcdb738 100644 --- a/authority/provisioners.go +++ b/authority/provisioners.go @@ -1,11 +1,10 @@ package authority import ( - "log" "net/http" "github.com/pkg/errors" - "github.com/smallstep/cli/jose" + "github.com/smallstep/ca-component/provisioner" ) // GetEncryptedKey returns the JWE key corresponding to the given kid argument. @@ -26,24 +25,6 @@ func (a *Authority) GetEncryptedKey(kid string) (string, error) { // GetProvisioners returns a map listing each provisioner and the JWK Key Set // with their public keys. -func (a *Authority) GetProvisioners() (map[string]*jose.JSONWebKeySet, error) { - pks := map[string]*jose.JSONWebKeySet{} - a.provisionerIDIndex.Range(func(key, val interface{}) bool { - p, ok := val.(*Provisioner) - if !ok { - log.Printf("authority.GetProvisioners: expected type *Provisioner, but got %T\n", val) - return true - } - ks, found := pks[p.Issuer] - if found { - ks.Keys = append(ks.Keys, *p.Key) - } else { - ks = new(jose.JSONWebKeySet) - ks.Keys = []jose.JSONWebKey{*p.Key} - pks[p.Issuer] = ks - } - return true - }) - return pks, nil - +func (a *Authority) GetProvisioners() ([]*provisioner.Provisioner, error) { + return a.config.AuthorityConfig.Provisioners, nil } diff --git a/authority/provisioners_test.go b/authority/provisioners_test.go index 9f6343dc..40efa318 100644 --- a/authority/provisioners_test.go +++ b/authority/provisioners_test.go @@ -6,7 +6,7 @@ import ( "github.com/pkg/errors" "github.com/smallstep/assert" - "github.com/smallstep/cli/jose" + "github.com/smallstep/ca-component/provisioner" ) func TestGetEncryptedKey(t *testing.T) { @@ -73,7 +73,7 @@ func TestGetEncryptedKey(t *testing.T) { if assert.Nil(t, tc.err) { val, ok := tc.a.provisionerIDIndex.Load(tc.kid) assert.Fatal(t, ok) - p, ok := val.(*Provisioner) + p, ok := val.(*provisioner.Provisioner) assert.Fatal(t, ok) assert.Equals(t, p.EncryptedKey, ek) } @@ -115,19 +115,7 @@ func TestGetProvisioners(t *testing.T) { } } else { if assert.Nil(t, tc.err) { - var cps = tc.a.config.AuthorityConfig.Provisioners - - maxks, found := ps["max"] - assert.Fatal(t, found) - assert.Equals(t, maxks.Keys, []jose.JSONWebKey{*cps[0].Key, *cps[1].Key}) - - marianoks, found := ps["mariano"] - assert.Fatal(t, found) - assert.Equals(t, marianoks.Keys, []jose.JSONWebKey{*cps[3].Key, *cps[4].Key}) - - stepcliks, found := ps["step-cli"] - assert.Fatal(t, found) - assert.Equals(t, stepcliks.Keys, []jose.JSONWebKey{*cps[2].Key}) + assert.Equals(t, ps, tc.a.config.AuthorityConfig.Provisioners) } } }) diff --git a/authority/tls.go b/authority/tls.go index fa9210c5..c2eda620 100644 --- a/authority/tls.go +++ b/authority/tls.go @@ -143,15 +143,15 @@ func (a *Authority) Renew(ocx *x509.Certificate) (*x509.Certificate, *x509.Certi ExtKeyUsage: oldCert.ExtKeyUsage, UnknownExtKeyUsage: oldCert.UnknownExtKeyUsage, BasicConstraintsValid: oldCert.BasicConstraintsValid, - IsCA: oldCert.IsCA, - MaxPathLen: oldCert.MaxPathLen, - MaxPathLenZero: oldCert.MaxPathLenZero, - OCSPServer: oldCert.OCSPServer, - IssuingCertificateURL: oldCert.IssuingCertificateURL, - DNSNames: oldCert.DNSNames, - EmailAddresses: oldCert.EmailAddresses, - IPAddresses: oldCert.IPAddresses, - URIs: oldCert.URIs, + IsCA: oldCert.IsCA, + MaxPathLen: oldCert.MaxPathLen, + MaxPathLenZero: oldCert.MaxPathLenZero, + OCSPServer: oldCert.OCSPServer, + IssuingCertificateURL: oldCert.IssuingCertificateURL, + DNSNames: oldCert.DNSNames, + EmailAddresses: oldCert.EmailAddresses, + IPAddresses: oldCert.IPAddresses, + URIs: oldCert.URIs, PermittedDNSDomainsCritical: oldCert.PermittedDNSDomainsCritical, PermittedDNSDomains: oldCert.PermittedDNSDomains, ExcludedDNSDomains: oldCert.ExcludedDNSDomains, diff --git a/ca/ca_test.go b/ca/ca_test.go index 48463f5f..0c7e17e8 100644 --- a/ca/ca_test.go +++ b/ca/ca_test.go @@ -298,16 +298,65 @@ func TestCAProvisioners(t *testing.T) { tc.ca.srv.Handler.ServeHTTP(rr, rq) + if assert.Equals(t, rr.Code, tc.status) { + body := &ClosingBuffer{rr.Body} + if rr.Code < http.StatusBadRequest { + var resp api.ProvisionersResponse + + assert.FatalError(t, readJSON(body, &resp)) + assert.Equals(t, config.AuthorityConfig.Provisioners, resp.Provisioners) + } else { + err := readError(body) + if len(tc.errMsg) == 0 { + assert.FatalError(t, errors.New("must validate response error")) + } + assert.HasPrefix(t, err.Error(), tc.errMsg) + } + } + }) + } +} + +func TestCAJWKSetByIssuer(t *testing.T) { + config, err := authority.LoadConfiguration("testdata/ca.json") + assert.FatalError(t, err) + ca, err := New(config) + assert.FatalError(t, err) + + type ekt struct { + ca *CA + status int + errMsg string + } + tests := map[string]func(t *testing.T) *ekt{ + "ok": func(t *testing.T) *ekt { + return &ekt{ + ca: ca, + status: http.StatusOK, + } + }, + } + + for name, genTestCase := range tests { + t.Run(name, func(t *testing.T) { + tc := genTestCase(t) + + rq, err := http.NewRequest("GET", fmt.Sprintf("/provisioners/jwk-set-by-issuer"), strings.NewReader("")) + assert.FatalError(t, err) + rr := httptest.NewRecorder() + + tc.ca.srv.Handler.ServeHTTP(rr, rq) + if assert.Equals(t, rr.Code, tc.status) { body := &ClosingBuffer{rr.Body} if rr.Code < http.StatusBadRequest { var ( - resp api.ProvisionersResponse + resp api.JWKSetByIssuerResponse psList = config.AuthorityConfig.Provisioners ) assert.FatalError(t, readJSON(body, &resp)) - psMap := resp.Provisioners + psMap := resp.Map maxks, found := psMap["max"] assert.Fatal(t, found) diff --git a/ca/client_test.go b/ca/client_test.go index 8540356c..0d6f555d 100644 --- a/ca/client_test.go +++ b/ca/client_test.go @@ -13,7 +13,7 @@ import ( "time" "github.com/smallstep/ca-component/api" - "github.com/smallstep/cli/jose" + "github.com/smallstep/ca-component/provisioner" ) const ( @@ -388,6 +388,66 @@ func TestClient_Renew(t *testing.T) { } } +func TestClient_Provisioners(t *testing.T) { + ok := &api.ProvisionersResponse{ + Provisioners: []*provisioner.Provisioner{}, + } + internalServerError := api.InternalServerError(fmt.Errorf("Internal Server Error")) + + tests := []struct { + name string + response interface{} + responseCode int + wantErr bool + }{ + {"ok", ok, 200, false}, + {"fail", internalServerError, 500, true}, + } + + srv := httptest.NewServer(nil) + defer srv.Close() + + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + c, err := NewClient(srv.URL, WithTransport(http.DefaultTransport)) + if err != nil { + t.Errorf("NewClient() error = %v", err) + return + } + + srv.Config.Handler = http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) { + expected := "/provisioners" + if req.RequestURI != expected { + t.Errorf("RequestURI = %s, want %s", req.RequestURI, expected) + } + w.WriteHeader(tt.responseCode) + api.JSON(w, tt.response) + }) + + got, err := c.Provisioners() + if (err != nil) != tt.wantErr { + t.Errorf("Client.Provisioners() error = %v, wantErr %v", err, tt.wantErr) + return + } + + switch { + case err != nil: + if got != nil { + t.Errorf("Client.Provisioners() = %v, want nil", got) + } + if !reflect.DeepEqual(err, tt.response) { + t.Errorf("Client.Provisioners() error = %v, want %v", err, tt.response) + } + default: + if !reflect.DeepEqual(got, tt.response) { + t.Errorf("Client.Provisioners() = %v, want %v", got, tt.response) + } + } + }) + } +} + +/* func TestClient_Provisioners(t *testing.T) { ok := &api.ProvisionersResponse{ Provisioners: map[string]*jose.JSONWebKeySet{}, @@ -446,6 +506,7 @@ func TestClient_Provisioners(t *testing.T) { }) } } +*/ func TestClient_ProvisionerKey(t *testing.T) { ok := &api.ProvisionerKeyResponse{ diff --git a/provisioner/provisioner.go b/provisioner/provisioner.go new file mode 100644 index 00000000..594da019 --- /dev/null +++ b/provisioner/provisioner.go @@ -0,0 +1,31 @@ +package provisioner + +import ( + "errors" + + jose "gopkg.in/square/go-jose.v2" +) + +// Provisioner - authorized entity that can sign tokens necessary for signature requests. +type Provisioner struct { + Issuer string `json:"issuer,omitempty"` + Type string `json:"type,omitempty"` + Key *jose.JSONWebKey `json:"key,omitempty"` + EncryptedKey string `json:"encryptedKey,omitempty"` +} + +// Validate validates a provisioner. +func (p *Provisioner) Validate() error { + switch { + case p.Issuer == "": + return errors.New("provisioner issuer cannot be empty") + + case p.Type == "": + return errors.New("provisioner type cannot be empty") + + case p.Key == nil: + return errors.New("provisioner key cannot be empty") + } + + return nil +} diff --git a/provisioner/provisioner_test.go b/provisioner/provisioner_test.go new file mode 100644 index 00000000..8f1e6f18 --- /dev/null +++ b/provisioner/provisioner_test.go @@ -0,0 +1,55 @@ +package provisioner + +import ( + "errors" + "testing" + + "github.com/smallstep/assert" + jose "gopkg.in/square/go-jose.v2" +) + +func TestProvisionerValidate(t *testing.T) { + type ProvisionerValidateTest struct { + p *Provisioner + err error + } + tests := map[string]func(*testing.T) ProvisionerValidateTest{ + "fail-empty-issuer": func(t *testing.T) ProvisionerValidateTest { + return ProvisionerValidateTest{ + p: &Provisioner{}, + err: errors.New("provisioner issuer cannot be empty"), + } + }, + "fail-empty-type": func(t *testing.T) ProvisionerValidateTest { + return ProvisionerValidateTest{ + p: &Provisioner{Issuer: "foo"}, + err: errors.New("provisioner type cannot be empty"), + } + }, + "fail-empty-key": func(t *testing.T) ProvisionerValidateTest { + return ProvisionerValidateTest{ + p: &Provisioner{Issuer: "foo", Type: "bar"}, + err: errors.New("provisioner key cannot be empty"), + } + }, + "ok": func(t *testing.T) ProvisionerValidateTest { + return ProvisionerValidateTest{ + p: &Provisioner{Issuer: "foo", Type: "bar", Key: &jose.JSONWebKey{}}, + } + }, + } + + for name, get := range tests { + t.Run(name, func(t *testing.T) { + tc := get(t) + err := tc.p.Validate() + if err != nil { + if assert.NotNil(t, tc.err) { + assert.Equals(t, tc.err.Error(), err.Error()) + } + } else { + assert.Nil(t, tc.err) + } + }) + } +}