Use S3 object expiry for OCSP snapshots

server/tests/test_config.py

@@ -0,0 +1,32 @@
+"""Environment configuration tests."""
+from __future__ import annotations
+
+import os
+import unittest
+from unittest.mock import patch
+
+from kca.config import Settings
+
+
+class OcspExpirySettingsTest(unittest.TestCase):
+    def test_defaults(self) -> None:
+        with patch.dict(os.environ, {}, clear=True):
+            settings = Settings.from_env()
+        self.assertEqual(30, settings.ocsp_heartbeat_interval_seconds)
+        self.assertEqual(60, settings.ocsp_object_expiry_seconds)
+
+    def test_expiry_must_exceed_heartbeat(self) -> None:
+        with patch.dict(
+            os.environ,
+            {
+                "KCA_OCSP_HEARTBEAT_INTERVAL_SECONDS": "30",
+                "KCA_OCSP_OBJECT_EXPIRY_SECONDS": "30",
+            },
+            clear=True,
+        ):
+            with self.assertRaisesRegex(RuntimeError, "must be greater"):
+                Settings.from_env()
+
+
+if __name__ == "__main__":
+    unittest.main()

server/tests/test_routes_extra.py

@@ -941,7 +941,8 @@ class OcspSnapshotTests(unittest.TestCase):
                 payload = response.json()
                 assert payload["enabled"] is False
                 snapshot = payload["snapshot"]
-                assert snapshot["schema"] == "kca-ocsp-status/v1"
+                assert snapshot["schema"] == "kca-ocsp-status/v2"
+                assert "generated_at" not in snapshot
                 assert snapshot["issuer"]["sha256"] == ca["fingerprint_sha256"]
                 entries = {entry["serial_hex"]: entry for entry in snapshot["entries"]}
                 assert len(snapshot["entries"]) == 1
@@ -1260,7 +1261,10 @@ class OcspSnapshotTests(unittest.TestCase):
                 call = fake.calls[0]
                 assert call["Bucket"] == "test-bucket"
                 assert call["Key"] == f"ocsp/{ca['id']}.json"
-                assert b"kca-ocsp-status/v1" in call["Body"]
+                assert b"kca-ocsp-status/v2" in call["Body"]
+                assert b"generated_at" not in call["Body"]
+                expires_in = (call["Expires"] - datetime.now(timezone.utc)).total_seconds()
+                assert 50 < expires_in <= 60
                 row = await OcspSnapshot.get(ca_id=ca["id"])
                 assert row.dirty is False
                 assert row.published_at is not None