From 87440d5a23f0fd894d949295a7c1ff85043550fc Mon Sep 17 00:00:00 2001 From: salmonik Date: Wed, 28 Oct 2026 22:55:51 +0100 Subject: v0.4.0: add first-time TLS setup and server help --- tests/server_setup.rs | 38 ++++++++++++++++++++++++++++++++++++++ 1 file changed, 38 insertions(+) create mode 100644 tests/server_setup.rs (limited to 'tests/server_setup.rs') diff --git a/tests/server_setup.rs b/tests/server_setup.rs new file mode 100644 index 0000000..d527cd9 --- /dev/null +++ b/tests/server_setup.rs @@ -0,0 +1,38 @@ +use std::path::PathBuf; + +use zagan_bet::server::setup::init_identity; + +#[test] +fn creates_a_usable_pkcs12_identity_and_refuses_to_overwrite() { + let dir = PathBuf::from(env!("CARGO_TARGET_TMPDIR")).join("server-setup"); + let _ = std::fs::remove_dir_all(&dir); + std::fs::create_dir_all(&dir).unwrap(); + + init_identity(&dir, "localhost").expect("openssl must be available for this test"); + + for name in ["identity.p12", "key.pem", "cert.pem"] { + let path = dir.join(name); + assert!(path.exists(), "{name} was not created"); + assert!( + std::fs::metadata(&path).unwrap().len() > 0, + "{name} is empty" + ); + } + + let p12 = std::fs::read(dir.join("identity.p12")).unwrap(); + native_tls::Identity::from_pkcs12(&p12, "").expect("generated identity must load"); + + let second = init_identity(&dir, "localhost"); + assert!(second.is_err(), "setup must not overwrite existing keys"); + + #[cfg(unix)] + { + use std::os::unix::fs::PermissionsExt; + let mode = std::fs::metadata(dir.join("key.pem")) + .unwrap() + .permissions() + .mode() + & 0o777; + assert_eq!(mode, 0o600, "private key should not be world-readable"); + } +} -- cgit v1.2.3