nordisk/edda

crates/estate-front/tests/airgap_no_acme.rs

//! ★ A32-11 (AIRGAP B1, owner rule 7): **estate-front's default build links no ACME client and
//! dials no ACME directory.** The client is the `acme` feature (default off): without it an
//! attempt is refused by name ([`estate_front::web::acme::NOT_BUILT`]) and the front serves a
//! fed or kept certificate. A product front that takes its certificate from Let's Encrypt names
//! the feature (holger-estate-front, the ONE box's monetize-admin).
#![cfg(not(feature = "acme"))]

use estate_front::web::acme::{issue_as, Challenges, FailKind, NOT_BUILT};

#[tokio::test]
async fn the_default_front_refuses_acme_by_name_and_dials_nothing() {
    let dir = tempfile::tempdir().unwrap();
    // A directory on a port nothing listens on: a dial would fail as a connection error, not as
    // NOT_BUILT.
    let f = issue_as(dir.path(), &["example.test".to_string()], "http://127.0.0.1:9/directory", None, &Challenges::default()).await.expect_err("no ACME client in this build");
    assert_eq!((f.kind, f.text.as_str()), (FailKind::Acme, NOT_BUILT));
}

#[test]
fn the_default_tree_holds_no_acme_client() {
    let manifest = concat!(env!("CARGO_MANIFEST_DIR"), "/Cargo.toml");
    let out = std::process::Command::new(env!("CARGO")).args(["tree", "-e", "normal", "--prefix", "none", "--manifest-path", manifest]).output().expect("cargo tree");
    assert!(out.status.success(), "{}", String::from_utf8_lossy(&out.stderr));
    let tree = String::from_utf8_lossy(&out.stdout);
    assert!(tree.contains("estate-front v"), "cargo tree produced no tree: {tree}");
    assert!(!tree.contains("instant-acme v"), "the default estate-front links instant-acme:\n{tree}");
}