1 files changed, 38 insertions, 0 deletions

diff --git a/tests/server_setup.rs b/tests/server_setup.rs
new file mode 100644
index 0000000..d527cd9
--- /dev/null
+++ b/tests/server_setup.rs
@@ -0,0 +1,38 @@
+use std::path::PathBuf;
+
+use zagan_bet::server::setup::init_identity;
+
+#[test]
+fn creates_a_usable_pkcs12_identity_and_refuses_to_overwrite() {
+    let dir = PathBuf::from(env!("CARGO_TARGET_TMPDIR")).join("server-setup");
+    let _ = std::fs::remove_dir_all(&dir);
+    std::fs::create_dir_all(&dir).unwrap();
+
+    init_identity(&dir, "localhost").expect("openssl must be available for this test");
+
+    for name in ["identity.p12", "key.pem", "cert.pem"] {
+        let path = dir.join(name);
+        assert!(path.exists(), "{name} was not created");
+        assert!(
+            std::fs::metadata(&path).unwrap().len() > 0,
+            "{name} is empty"
+        );
+    }
+
+    let p12 = std::fs::read(dir.join("identity.p12")).unwrap();
+    native_tls::Identity::from_pkcs12(&p12, "").expect("generated identity must load");
+
+    let second = init_identity(&dir, "localhost");
+    assert!(second.is_err(), "setup must not overwrite existing keys");
+
+    #[cfg(unix)]
+    {
+        use std::os::unix::fs::PermissionsExt;
+        let mode = std::fs::metadata(dir.join("key.pem"))
+            .unwrap()
+            .permissions()
+            .mode()
+            & 0o777;
+        assert_eq!(mode, 0o600, "private key should not be world-readable");
+    }
+}