#16: implement DKIM key provisioning, Ed25519 & RSA dual signatures and rotation

services/protocols/internal/application/usecase/provision_dkim_keys_test.go

@@ -0,0 +1,128 @@
+package usecase
+
+import (
+	"context"
+	"fmt"
+	"testing"
+)
+
+type fakeDkimStore struct {
+	// keyed by algorithm
+	publicKeys map[string]string
+	inserts    int
+}
+
+func newFakeDkimStore() *fakeDkimStore {
+	return &fakeDkimStore{publicKeys: map[string]string{}}
+}
+
+func (f *fakeDkimStore) FindPublicKey(_ context.Context, _, algorithm string) (string, error) {
+	return f.publicKeys[algorithm], nil
+}
+
+func (f *fakeDkimStore) Insert(_ context.Context, _, _, algorithm string, _ []byte, publicKey string) error {
+	f.inserts++
+	if _, exists := f.publicKeys[algorithm]; exists {
+		return nil // an active key already won the race
+	}
+	f.publicKeys[algorithm] = publicKey
+	return nil
+}
+
+func countingGenerator(calls *int) DkimKeyGenerator {
+	return func(algorithm string) ([]byte, string, error) {
+		*calls++
+		return []byte("PEM-" + algorithm), fmt.Sprintf("PUB-%s-%d", algorithm, *calls), nil
+	}
+}
+
+// PLAN.md section 5 requires both an RSA and an Ed25519 key per domain, and
+// their public halves feed DNS records 5 and 6 (section 7.1).
+func TestProvisionDkimKeys_CreatesBothAlgorithms(t *testing.T) {
+	store := newFakeDkimStore()
+	var generated int
+
+	out, err := NewProvisionDkimKeysUseCase(store, countingGenerator(&generated)).
+		Execute(context.Background(), "example.test")
+	if err != nil {
+		t.Fatalf("Execute: %v", err)
+	}
+
+	if generated != 2 {
+		t.Errorf("generated %d keys, want 2", generated)
+	}
+	if out.RsaPublicKey == "" || out.Ed25519PublicKey == "" {
+		t.Errorf("missing public keys for DNS: rsa=%q ed25519=%q", out.RsaPublicKey, out.Ed25519PublicKey)
+	}
+	if len(out.Created) != 2 {
+		t.Errorf("Created = %v, want both algorithms", out.Created)
+	}
+}
+
+// Re-running onboarding must not mint new keys: rotating the DKIM key on
+// every sync would invalidate signatures already in flight.
+func TestProvisionDkimKeys_IsIdempotent(t *testing.T) {
+	store := newFakeDkimStore()
+	var generated int
+	uc := NewProvisionDkimKeysUseCase(store, countingGenerator(&generated))
+	ctx := context.Background()
+
+	first, err := uc.Execute(ctx, "example.test")
+	if err != nil {
+		t.Fatalf("first Execute: %v", err)
+	}
+
+	second, err := uc.Execute(ctx, "example.test")
+	if err != nil {
+		t.Fatalf("second Execute: %v", err)
+	}
+
+	if generated != 2 {
+		t.Errorf("generated %d keys across two runs, want 2", generated)
+	}
+	if len(second.Created) != 0 {
+		t.Errorf("second run reported creating %v, want nothing", second.Created)
+	}
+	if second.RsaPublicKey != first.RsaPublicKey || second.Ed25519PublicKey != first.Ed25519PublicKey {
+		t.Error("public keys changed between runs; DNS would be rewritten every sync")
+	}
+}
+
+// If another process wins the insert, the DNS record must carry the key that
+// actually became active, not the one this process generated and discarded.
+func TestProvisionDkimKeys_ReturnsStoredKeyAfterLostRace(t *testing.T) {
+	store := newFakeDkimStore()
+	store.publicKeys[rsaAlgorithm] = "" // absent on first read
+
+	uc := NewProvisionDkimKeysUseCase(&raceStore{inner: store}, countingGenerator(new(int)))
+
+	out, err := uc.Execute(context.Background(), "example.test")
+	if err != nil {
+		t.Fatalf("Execute: %v", err)
+	}
+	if out.RsaPublicKey != "PUB-WINNER" {
+		t.Errorf("RsaPublicKey = %q, want the key that won the insert", out.RsaPublicKey)
+	}
+}
+
+// raceStore reports no key on the first lookup, then a key inserted by
+// somebody else.
+type raceStore struct {
+	inner  *fakeDkimStore
+	probed map[string]bool
+}
+
+func (r *raceStore) FindPublicKey(ctx context.Context, domain, algorithm string) (string, error) {
+	if r.probed == nil {
+		r.probed = map[string]bool{}
+	}
+	if !r.probed[algorithm] {
+		r.probed[algorithm] = true
+		return "", nil
+	}
+	return "PUB-WINNER", nil
+}
+
+func (r *raceStore) Insert(ctx context.Context, domain, selector, algorithm string, pem []byte, publicKey string) error {
+	return nil
+}