wehub-resource-sync
185 lines
7.0 KiB
Lua
185 lines
7.0 KiB
Lua
local ssl_fixtures = require "spec.fixtures.ssl"
|
|
local helpers = require "spec.helpers"
|
|
local cjson = require "cjson"
|
|
|
|
|
|
for _, strategy in helpers.each_strategy() do
|
|
describe("/certificates with DB: #" .. strategy, function()
|
|
local client
|
|
local db
|
|
|
|
lazy_setup(function()
|
|
helpers.setenv("CERT", ssl_fixtures.cert)
|
|
helpers.setenv("KEY", ssl_fixtures.key)
|
|
|
|
local _
|
|
_, db = helpers.get_db_utils(strategy, {
|
|
"certificates",
|
|
"vaults",
|
|
},
|
|
nil, {
|
|
"env",
|
|
"mock",
|
|
})
|
|
|
|
assert(helpers.start_kong {
|
|
database = strategy,
|
|
prefix = helpers.test_conf.prefix,
|
|
nginx_conf = "spec/fixtures/custom_nginx.template",
|
|
vaults = "env,mock",
|
|
})
|
|
|
|
client = assert(helpers.admin_client(10000))
|
|
|
|
local res = client:put("/vaults/test-vault", {
|
|
headers = { ["Content-Type"] = "application/json" },
|
|
body = {
|
|
name = "env",
|
|
},
|
|
})
|
|
|
|
assert.res_status(200, res)
|
|
|
|
local res = client:put("/vaults/mock-vault", {
|
|
headers = { ["Content-Type"] = "application/json" },
|
|
body = {
|
|
name = "mock",
|
|
},
|
|
})
|
|
|
|
assert.res_status(200, res)
|
|
end)
|
|
|
|
before_each(function()
|
|
client = assert(helpers.admin_client(10000))
|
|
end)
|
|
|
|
after_each(function()
|
|
if client then
|
|
client:close()
|
|
end
|
|
end)
|
|
|
|
lazy_teardown(function()
|
|
helpers.stop_kong()
|
|
helpers.unsetenv("CERT")
|
|
helpers.unsetenv("KEY")
|
|
end)
|
|
|
|
it("create certificates with cert and key as secret", function()
|
|
local res, err = client:post("/certificates", {
|
|
headers = { ["Content-Type"] = "application/json" },
|
|
body = {
|
|
cert = "{vault://test-vault/cert}",
|
|
key = "{vault://test-vault/key}",
|
|
cert_alt = "{vault://unknown/cert}",
|
|
key_alt = "{vault://unknown/missing-key}",
|
|
},
|
|
})
|
|
assert.is_nil(err)
|
|
local body = assert.res_status(201, res)
|
|
local certificate = cjson.decode(body)
|
|
assert.equal("{vault://test-vault/cert}", certificate.cert)
|
|
assert.equal("{vault://test-vault/key}", certificate.key)
|
|
assert.equal("{vault://unknown/cert}", certificate.cert_alt)
|
|
assert.equal("{vault://unknown/missing-key}", certificate.key_alt)
|
|
assert.is_nil(certificate["$refs"])
|
|
|
|
certificate, err = db.certificates:select(certificate)
|
|
assert.is_nil(err)
|
|
assert.equal(ssl_fixtures.cert, certificate.cert)
|
|
assert.equal(ssl_fixtures.key, certificate.key)
|
|
assert.equal("{vault://test-vault/cert}", certificate["$refs"].cert)
|
|
assert.equal("{vault://test-vault/key}", certificate["$refs"].key)
|
|
assert.equal("{vault://unknown/cert}", certificate["$refs"].cert_alt)
|
|
assert.equal("{vault://unknown/missing-key}", certificate["$refs"].key_alt)
|
|
assert.equal("", certificate.cert_alt)
|
|
assert.equal("", certificate.key_alt)
|
|
|
|
-- process auto fields keeps the existing $refs
|
|
local certificate_b = db.certificates.schema:process_auto_fields(certificate, "select")
|
|
assert.same(certificate_b, certificate)
|
|
|
|
-- TODO: this is unexpected but schema.process_auto_fields uses currently
|
|
-- the `nulls` parameter to detect if the call comes from Admin API
|
|
-- for performance reasons
|
|
certificate, err = db.certificates:select(certificate, { nulls = true })
|
|
assert.is_nil(err)
|
|
assert.equal("{vault://test-vault/cert}", certificate.cert)
|
|
assert.equal("{vault://test-vault/key}", certificate.key)
|
|
assert.equal("{vault://unknown/cert}", certificate.cert_alt)
|
|
assert.equal("{vault://unknown/missing-key}", certificate.key_alt)
|
|
assert.is_nil(certificate["$refs"])
|
|
|
|
-- verify that certificate attributes are of type reference when querying
|
|
res, err = client:get("/certificates/"..certificate.id)
|
|
assert.is_nil(err)
|
|
body = assert.res_status(200, res)
|
|
certificate = cjson.decode(body)
|
|
assert.is_equal("{vault://test-vault/cert}", certificate.cert)
|
|
assert.is_equal("{vault://test-vault/key}", certificate.key)
|
|
assert.is_equal("{vault://unknown/cert}", certificate.cert_alt)
|
|
assert.is_equal("{vault://unknown/missing-key}", certificate.key_alt)
|
|
assert.is_nil(certificate["$refs"])
|
|
end)
|
|
|
|
it("create certificates with cert and key as secret using mock vault", function()
|
|
local res, err = client:post("/certificates", {
|
|
headers = { ["Content-Type"] = "application/json" },
|
|
body = {
|
|
cert = "{vault://mock-vault/cert}",
|
|
key = "{vault://mock-vault/key}",
|
|
cert_alt = "{vault://unknown/cert}",
|
|
key_alt = "{vault://unknown/missing-key}",
|
|
},
|
|
})
|
|
assert.is_nil(err)
|
|
local body = assert.res_status(201, res)
|
|
local certificate = cjson.decode(body)
|
|
assert.equal("{vault://mock-vault/cert}", certificate.cert)
|
|
assert.equal("{vault://mock-vault/key}", certificate.key)
|
|
assert.equal("{vault://unknown/cert}", certificate.cert_alt)
|
|
assert.equal("{vault://unknown/missing-key}", certificate.key_alt)
|
|
assert.is_nil(certificate["$refs"])
|
|
|
|
certificate, err = db.certificates:select(certificate)
|
|
assert.is_nil(err)
|
|
assert.equal(ssl_fixtures.cert, certificate.cert)
|
|
assert.equal(ssl_fixtures.key, certificate.key)
|
|
assert.equal("{vault://mock-vault/cert}", certificate["$refs"].cert)
|
|
assert.equal("{vault://mock-vault/key}", certificate["$refs"].key)
|
|
assert.equal("{vault://unknown/cert}", certificate["$refs"].cert_alt)
|
|
assert.equal("{vault://unknown/missing-key}", certificate["$refs"].key_alt)
|
|
assert.equal("", certificate.cert_alt)
|
|
assert.equal("", certificate.key_alt)
|
|
|
|
-- TODO: this is unexpected but schema.process_auto_fields uses currently
|
|
-- the `nulls` parameter to detect if the call comes from Admin API
|
|
-- for performance reasons
|
|
certificate, err = db.certificates:select(certificate, { nulls = true })
|
|
assert.is_nil(err)
|
|
assert.equal("{vault://mock-vault/cert}", certificate.cert)
|
|
assert.equal("{vault://mock-vault/key}", certificate.key)
|
|
assert.equal("{vault://unknown/cert}", certificate.cert_alt)
|
|
assert.equal("{vault://unknown/missing-key}", certificate.key_alt)
|
|
assert.is_nil(certificate["$refs"])
|
|
|
|
-- verify that certificate attributes are of type reference when querying
|
|
res, err = client:get("/certificates/"..certificate.id)
|
|
assert.is_nil(err)
|
|
body = assert.res_status(200, res)
|
|
certificate = cjson.decode(body)
|
|
assert.is_equal("{vault://mock-vault/cert}", certificate.cert)
|
|
assert.is_equal("{vault://mock-vault/key}", certificate.key)
|
|
assert.is_equal("{vault://unknown/cert}", certificate.cert_alt)
|
|
assert.is_equal("{vault://unknown/missing-key}", certificate.key_alt)
|
|
assert.is_nil(certificate["$refs"])
|
|
end)
|
|
|
|
it("generate correct cache key", function ()
|
|
local cache_key = db.vaults:cache_key("test")
|
|
assert.equal("vaults:test:::::", cache_key)
|
|
end)
|
|
end)
|
|
end
|