🚧 Add CA and server cert management

2026-09-19 13:35:49 +02:00
parent 45de68f0b7
commit 111d6cc390
20 changed files with 1317 additions and 34 deletions
@@ -77,5 +77,76 @@ def test_tls_listener_without_pki_warns(session):
    session.commit()

    result = generate_config(session)
-    assert any("PKI is not available" in w for w in result.warnings)
-    assert "tls_version tlsv1.2" in result.config_text
+    assert any("no certificate is bound" in w for w in result.warnings)
+    assert "tls_version tlsv1.2" in result.config_text
+
+
+def test_tls_listener_with_bound_certificate_emits_certfile(session):
+    """With PKI material bound, the generator emits real cert paths (spec 30)."""
+    from datetime import UTC, datetime
+
+    from app.crypto import encrypt_secret
+    from app.models import Certificate
+    from app.pki import create_ca, issue_server_certificate
+
+    ca_issued = create_ca(
+        common_name="Test CA", validity_days=3650, key_algorithm="ecdsa-p256"
+    )
+    ca = Certificate(
+        common_name="Test CA",
+        certificate_pem=ca_issued.certificate_pem,
+        private_key_pem=encrypt_secret(ca_issued.private_key_pem),
+        expiry_date=ca_issued.not_valid_after,
+        is_ca=True,
+        key_algorithm="ecdsa-p256",
+        serial_number=str(ca_issued.serial_number),
+        dns_sans=[],
+        ip_sans=[],
+        fingerprint="aa:bb",
+        status="issued",
+    )
+    session.add(ca)
+    session.flush()
+
+    leaf = issue_server_certificate(
+        ca_certificate_pem=ca_issued.certificate_pem,
+        ca_private_key_pem=ca_issued.private_key_pem,
+        common_name="broker.local",
+        validity_days=365,
+    )
+    cert = Certificate(
+        common_name="broker.local",
+        certificate_pem=leaf.certificate_pem,
+        private_key_pem=encrypt_secret(leaf.private_key_pem),
+        expiry_date=leaf.not_valid_after,
+        is_ca=False,
+        parent_id=ca.id,
+        key_algorithm="ecdsa-p256",
+        serial_number=str(leaf.serial_number),
+        dns_sans=["broker.local"],
+        ip_sans=[],
+        fingerprint="cc:dd",
+        status="issued",
+    )
+    session.add(cert)
+    session.flush()
+
+    session.add(
+        ListenerConfig(
+            name="tls-prod",
+            port=8883,
+            protocol="mqtt",
+            tls_enabled=True,
+            tls_min_version="tlsv1.2",
+            cert_id=cert.id,
+        )
+    )
+    session.commit()
+
+    result = generate_config(session)
+    text = result.config_text
+    assert f"certfile /mosquitto/certs/{cert.id}.crt" in text
+    assert f"keyfile /mosquitto/certs/{cert.id}.key" in text
+    assert f"cafile /mosquitto/certs/{ca.id}.crt" in text
+    assert "tls_version tlsv1.2" in text
+    assert result.warnings == []