Jarian Cottingham
4bd538b217
Critical: build_leaf_cert self-signed leaves with the leaf key instead of the YubiKey-held Intermediate CA key. Now extracts TBS, signs via pkcs11-tool (ECDSA-SHA384), reassembles, and verifies against the intermediate CA public key before returning. - setup-certauth.sh: ~1100 lines of stale inline api/ copies replaced with copy-from-repo (single source of truth); writes private /etc/certauth/certauth.env (0600); DB init loads env, no more swallowed errors; systemd unit gets EnvironmentFile= - config.py: YubiKey serials no longer hard-coded (env, fail closed); aarch64-only PKCS#11 path replaced with arch-neutral default; all paths env-overridable (CERTAUTH_*) - main.py: removed dead fastapi.security.CSRFProtection import (crashed startup); module-relative static/templates dirs; created_by resolved from the authenticated user instead of hard-coded 1; unclosed file handles fixed; domain_id 0 stored as NULL (FK bug) - models.py: certificates.domain_id FK pointed at users(id), now domains(id) - login: CSRF token now actually sent and validated - tests: 23 tests (auth, API flows, DER helpers, signing pipeline) - README, LICENSE, requirements.txt, pyproject.toml
32 lines
1.1 KiB
Python
32 lines
1.1 KiB
Python
"""Test setup: configure the environment before importing the app.
|
|
|
|
The API fails closed on missing configuration (by design), so tests
|
|
provide a complete, isolated environment pointing at a temp directory.
|
|
"""
|
|
|
|
import os
|
|
import sys
|
|
import tempfile
|
|
from pathlib import Path
|
|
|
|
API_DIR = Path(__file__).resolve().parent.parent / "api"
|
|
sys.path.insert(0, str(API_DIR))
|
|
|
|
_TMP = tempfile.mkdtemp(prefix="certauth-test-")
|
|
|
|
os.environ["YK_ROOT_SERIAL"] = "10000001"
|
|
os.environ["YK_INT_SERIAL"] = "10000002"
|
|
os.environ["YK_ROOT_PIN"] = "123456"
|
|
os.environ["YK_INT_PIN"] = "234567"
|
|
os.environ["JWT_SECRET"] = "test-secret-0123456789abcdef0123456789abcdef"
|
|
os.environ["ADMIN_USERNAME"] = "certauth"
|
|
os.environ["ADMIN_PASSWORD"] = "test-admin-pass-123"
|
|
os.environ["CERTAUTH_DB_PATH"] = os.path.join(_TMP, "test.db")
|
|
os.environ["CERTAUTH_TMP_DIR"] = os.path.join(_TMP, "tmp")
|
|
os.environ["CERTAUTH_CA_BASE"] = os.path.join(_TMP, "ca")
|
|
os.environ["CERTAUTH_ISSUED_DIR"] = os.path.join(_TMP, "ca", "issued")
|
|
os.environ["PKCS11_MODULE"] = "/usr/lib/opensc-pkcs11.so"
|
|
|
|
os.makedirs(os.environ["CERTAUTH_ISSUED_DIR"], exist_ok=True)
|
|
os.makedirs(os.environ["CERTAUTH_TMP_DIR"], exist_ok=True)
|