feat: initial commit

tests/test_certificates.py

@@ -0,0 +1,119 @@
+import base64
+import subprocess
+from unittest.mock import MagicMock
+
+import pytest
+
+from id_configurator.config import Configuration
+from id_configurator.context import Context
+from id_configurator.modules.certificates import CertificatesModule
+
+CERT_CONTENT = base64.b64encode(b"fake-cert-bytes").decode("ascii")
+
+
+def make_config(with_certificate: bool) -> Configuration:
+    data = {
+        "uuid": "12345678-1234-5678-1234-567812345678",
+        "organisation": "InterDiode",
+    }
+    if with_certificate:
+        data["configurations"] = {
+            "certificates": [{"name": "new-root-ca", "content": CERT_CONTENT}]
+        }
+    return Configuration.model_validate(data)
+
+
+def test_is_relevant_true_when_certificates_configured(tmp_path) -> None:
+    context = Context(config=make_config(True), dst=tmp_path / "dst", src=None)
+    assert CertificatesModule().is_relevant(context) is True  # nosec B101
+
+
+def test_is_relevant_false_when_no_certificates(tmp_path) -> None:
+    context = Context(config=make_config(False), dst=tmp_path / "dst", src=None)
+    assert CertificatesModule().is_relevant(context) is False  # nosec B101
+
+
+def _mock_success(monkeypatch, stderr: str = "") -> MagicMock:
+    mock_run = MagicMock(
+        return_value=subprocess.CompletedProcess(
+            args=[], returncode=0, stdout="", stderr=stderr
+        )
+    )
+    monkeypatch.setattr("id_configurator.modules.certificates.subprocess.run", mock_run)
+    return mock_run
+
+
+def test_apply_writes_certificate_and_calls_update_ca_certificates(
+    tmp_path, monkeypatch
+) -> None:
+    mock_run = _mock_success(monkeypatch)
+    dst = tmp_path / "dst"
+    context = Context(config=make_config(True), dst=dst, src=None)
+
+    CertificatesModule().apply(context)
+
+    written = dst / "usr/local/share/ca-certificates/new-root-ca.crt"
+    assert written.read_bytes() == b"fake-cert-bytes"  # nosec B101
+    mock_run.assert_called_once()
+    args = mock_run.call_args.args[0]
+    assert args[0] == "update-ca-certificates"  # nosec B101
+    assert "--certsconf" not in args  # nosec B101
+    assert "--certsdir" not in args  # nosec B101
+
+
+def test_apply_preserves_existing_local_certificates_from_src(
+    tmp_path, monkeypatch
+) -> None:
+    mock_run = _mock_success(monkeypatch, stderr="some warning")
+    src = tmp_path / "src"
+    local_certs_dir = src / "usr/local/share/ca-certificates"
+    local_certs_dir.mkdir(parents=True)
+    (local_certs_dir / "existing.crt").write_bytes(b"existing-bytes")
+    (local_certs_dir / "new-root-ca.crt").write_bytes(
+        b"stale-bytes-should-be-overwritten"
+    )
+    (src / "etc/ca-certificates.conf").parent.mkdir(parents=True)
+    (src / "etc/ca-certificates.conf").write_text("existing.crt\n", encoding="utf-8")
+    (src / "usr/share/ca-certificates").mkdir(parents=True)
+
+    dst = tmp_path / "dst"
+    context = Context(config=make_config(True), dst=dst, src=src)
+
+    CertificatesModule().apply(context)
+
+    local_dst = dst / "usr/local/share/ca-certificates"
+    assert (local_dst / "existing.crt").read_bytes() == b"existing-bytes"  # nosec B101
+    assert (local_dst / "new-root-ca.crt").read_bytes() == b"fake-cert-bytes"  # nosec B101
+
+    args = mock_run.call_args.args[0]
+    assert "--certsconf" in args  # nosec B101
+    assert str(src / "etc/ca-certificates.conf") in args  # nosec B101
+    assert "--certsdir" in args  # nosec B101
+    assert str(src / "usr/share/ca-certificates") in args  # nosec B101
+
+
+def test_update_ca_certificates_raises_when_binary_missing(
+    tmp_path, monkeypatch
+) -> None:
+    monkeypatch.setattr(
+        "id_configurator.modules.certificates.subprocess.run",
+        MagicMock(side_effect=FileNotFoundError()),
+    )
+    context = Context(config=make_config(True), dst=tmp_path / "dst", src=None)
+
+    with pytest.raises(RuntimeError, match="update-ca-certificates is not available"):
+        CertificatesModule().apply(context)
+
+
+def test_update_ca_certificates_raises_on_failure(tmp_path, monkeypatch) -> None:
+    error = subprocess.CalledProcessError(
+        returncode=1, cmd=["update-ca-certificates"], stderr="boom"
+    )
+    monkeypatch.setattr(
+        "id_configurator.modules.certificates.subprocess.run",
+        MagicMock(side_effect=error),
+    )
+    context = Context(config=make_config(True), dst=tmp_path / "dst", src=None)
+
+    with pytest.raises(RuntimeError, match="update-ca-certificates failed"):
+        CertificatesModule().apply(context)  # nosec B101