woggioni/kca
2
0
Fork 0
Code Actions Packages Releases Activity

Add server template apply modes, bulk revocation, explicit DN order and detail tabs

Browse Source
This commit is contained in:
woggioni
2026-10-23 05:33:43 +00:00
parent 5eb7866f5b
commit 763268bd40
13 changed files with 1477 additions and 633 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/tests/test_routes_extra.py
+74 -1
View File
@@ -152,6 +152,30 @@ class RouteExtraTests(unittest.TestCase):
)
assert response.status_code == 200
assert response.json()["extensions"]["basic_constraints"]["ca"] is True
response = await client.post(
f"/api/vaults/{vault_id}/templates/builtin:tls-server/apply",
json={
"target": {
"subject": [{"name": "CN", "value": "keep.example.com"}],
"extensions": {},
},
"apply_subject": False,
"apply_extensions": True,
},
)
assert response.status_code == 200
merged = response.json()
assert merged["subject"] == [{"name": "CN", "value": "keep.example.com"}]
assert "serverAuth" in merged["extensions"]["extended_key_usage"]["usages"]
settings_response = await client.get(f"/api/vaults/{vault_id}/settings")
response = await client.patch(
f"/api/vaults/{vault_id}/settings",
json={
"settings": {"explicit_dn": ["CN", "not-a-real-attribute"]},
"version": settings_response.json()["version"],
},
)
assert response.status_code == 400
@async_test
async def test_revocation_and_crl(self) -> None:
@@ -303,6 +327,55 @@ class VaultExportTests(unittest.TestCase):
names = archive.namelist()
assert "manifest.json" in names
assert any(name.startswith("certificates/") for name in names)
assert any(name.startswith("keys/") for name in names)
key_files = [name for name in names if name.startswith("keys/") and name.endswith(".key")]
assert key_files
assert b"BEGIN ENCRYPTED PRIVATE KEY" in archive.read(key_files[0])
manifest = archive.read("manifest.json")
assert b"Zip Cert" in manifest
class BulkRevocationTests(unittest.TestCase):
@async_test
async def test_bulk_revoke_reports_skips_and_errors(self) -> None:
async with api_client() as client:
with oidc_user("alice"):
vault_id = await _vault(client)
ca_key = await _key(client, vault_id, "bulk ca")
ca = await _cert(client, vault_id, ca_key["id"], "Bulk CA", ca=True)
leaf1_key = await _key(client, vault_id, "leaf1")
leaf1 = await _cert(client, vault_id, leaf1_key["id"], "Leaf 1", signer_id=ca["id"])
leaf2_key = await _key(client, vault_id, "leaf2")
leaf2 = await _cert(client, vault_id, leaf2_key["id"], "Leaf 2", signer_id=ca["id"])
self_key = await _key(client, vault_id, "self")
self_signed = await _cert(client, vault_id, self_key["id"], "Self")
response = await client.post(
f"/api/vaults/{vault_id}/certificates/bulk-revoke",
json={
"certificate_ids": [leaf1["id"], leaf2["id"], self_signed["id"]],
"reason": "keyCompromise",
},
)
assert response.status_code == 200, response.text
result = response.json()
assert len(result["revoked"]) == 2
assert len(result["errors"]) == 1
assert result["errors"][0]["id"] == self_signed["id"]
response = await client.get(f"/api/vaults/{vault_id}/certificates/{leaf1['id']}")
assert response.json()["revoked"] is True
response = await client.post(
f"/api/vaults/{vault_id}/certificates/bulk-revoke",
json={"certificate_ids": [leaf1["id"], leaf2["id"]], "reason": "superseded"},
)
assert response.status_code == 200, response.text
assert len(response.json()["skipped"]) == 2
response = await client.post(
f"/api/vaults/{vault_id}/certificates/bulk-revoke",
json={"certificate_ids": [], "reason": "superseded"},
)
assert response.status_code == 400
response = await client.post(
f"/api/vaults/{vault_id}/certificates/bulk-revoke",
json={"certificate_ids": ["not-a-uuid"], "reason": "superseded"},
)
assert response.status_code == 200
assert response.json()["errors"][0]["error"] == "invalid certificate id"