Make public key extraction idempotent

2026-10-26 10:55:24 +00:00
parent c1d8711cb4
commit 7523c0b8c4
4 changed files with 83 additions and 5 deletions
@@ -177,6 +177,52 @@ class RouteExtraTests(unittest.TestCase):
                response = await client.get(f"/api/vaults/{vault_id}/requests/{request['id']}")
                assert response.json()["signed"] is True

+    @async_test
+    async def test_public_key_extraction_is_idempotent(self) -> None:
+        async with api_client() as client:
+            with oidc_user("alice"):
+                vault_id = await _vault(client)
+                key = await _key(client, vault_id, "leaf key")
+                cert = await _cert(client, vault_id, key["id"], "Leaf")
+
+                # The certificate's key already exists in the vault.
+                response = await client.post(
+                    f"/api/vaults/{vault_id}/certificates/{cert['id']}/transform/open-key"
+                )
+                assert response.status_code == 200, response.text
+                assert response.json()["id"] == key["id"]
+
+                response = await client.post(
+                    f"/api/vaults/{vault_id}/requests",
+                    json={
+                        "name": "web request",
+                        "subject": _subject("web.example.com"),
+                        "new_key": {"key_type": "ec", "curve": "secp256r1", "name": "web key"},
+                    },
+                )
+                assert response.status_code == 201, response.text
+                request = response.json()
+                response = await client.post(
+                    f"/api/vaults/{vault_id}/requests/{request['id']}/transform/open-key"
+                )
+                assert response.status_code == 200, response.text
+                assert response.json()["id"] == request["key_id"]
+
+                # When the key is absent, extraction creates it once and then reuses it.
+                await client.delete(f"/api/vaults/{vault_id}/keys/{key['id']}")
+                response = await client.post(
+                    f"/api/vaults/{vault_id}/certificates/{cert['id']}/transform/open-key"
+                )
+                assert response.status_code == 201, response.text
+                extracted = response.json()
+                response = await client.post(
+                    f"/api/vaults/{vault_id}/certificates/{cert['id']}/transform/open-key"
+                )
+                assert response.status_code == 200, response.text
+                assert response.json()["id"] == extracted["id"]
+                keys = (await client.get(f"/api/vaults/{vault_id}/keys")).json()["results"]
+                assert len(keys) == 2
+
    @async_test
    async def test_invalid_csr_signature_cannot_be_issued(self) -> None:
        from cryptography import x509