refactor: remove unused NPM_TO_COPY variable from build.py

Signed-off-by: d9pouces <github@19pouces.net>

tests/test_config.py

@@ -1,7 +1,14 @@
 import base64
+import datetime
 import json
+from unittest.mock import MagicMock
 
 import pytest
+from cryptography import x509
+from cryptography.hazmat.primitives import hashes
+from cryptography.hazmat.primitives.asymmetric import rsa
+from cryptography.hazmat.primitives.serialization import Encoding
+from cryptography.x509.oid import NameOID
 
 from id_configurator.config import (
     AptSource,
@@ -98,10 +105,69 @@ def test_load_configuration_from_env() -> None:
 
 
 def test_load_configuration_without_source_raises() -> None:
-    with pytest.raises(ValueError, match="either --config or --config-env"):
+    with pytest.raises(
+        ValueError, match="either --config, --config-env or --config-url"
+    ):
         load_configuration(None, None)
 
 
+def _mock_urlopen(content: bytes) -> MagicMock:
+    response = MagicMock()
+    response.read.return_value = content
+    response.__enter__.return_value = response
+    response.__exit__.return_value = False
+    return MagicMock(return_value=response)
+
+
+def _self_signed_ca_pem() -> str:
+    key = rsa.generate_private_key(public_exponent=65537, key_size=2048)
+    subject = issuer = x509.Name(
+        [x509.NameAttribute(NameOID.COMMON_NAME, "test-config-url-ca")]
+    )
+    now = datetime.datetime.now(datetime.UTC)
+    cert = (
+        x509.CertificateBuilder()
+        .subject_name(subject)
+        .issuer_name(issuer)
+        .public_key(key.public_key())
+        .serial_number(x509.random_serial_number())
+        .not_valid_before(now)
+        .not_valid_after(now + datetime.timedelta(days=1))
+        .sign(key, hashes.SHA256())
+    )
+    return cert.public_bytes(Encoding.PEM).decode("ascii")
+
+
+def test_load_configuration_from_url(monkeypatch) -> None:
+    mock_urlopen = _mock_urlopen(json.dumps(FULL_CONFIG).encode("utf-8"))
+    monkeypatch.setattr("id_configurator.config.urllib.request.urlopen", mock_urlopen)
+
+    configuration = load_configuration(
+        None, None, "https://example.invalid/config.json"
+    )
+
+    assert configuration.organisation == "InterDiode"
+    args, kwargs = mock_urlopen.call_args
+    assert args[0] == "https://example.invalid/config.json"
+    assert kwargs["timeout"] == 30
+    assert kwargs["context"].verify_mode.name == "CERT_REQUIRED"
+
+
+def test_load_configuration_from_url_with_custom_cacert(monkeypatch) -> None:
+    mock_urlopen = _mock_urlopen(json.dumps(FULL_CONFIG).encode("utf-8"))
+    monkeypatch.setattr("id_configurator.config.urllib.request.urlopen", mock_urlopen)
+    cacert_content = _self_signed_ca_pem()
+
+    configuration = load_configuration(
+        None, None, "https://example.invalid/config.json", cacert_content
+    )
+
+    assert configuration.organisation == "InterDiode"
+    _, kwargs = mock_urlopen.call_args
+    stats = kwargs["context"].cert_store_stats()
+    assert stats["x509"] == 1
+
+
 def test_apt_source_to_deb822_minimal() -> None:
     source = AptSource(
         name="interdiode", uris=["http://example.invalid/debian"], suites=["stable"]