Skip to content

replace old ocsp and crl apiTests with new integration tests#120

Merged
heskew merged 8 commits intomainfrom
cert-verification-integration-tests
Apr 5, 2026
Merged

replace old ocsp and crl apiTests with new integration tests#120
heskew merged 8 commits intomainfrom
cert-verification-integration-tests

Conversation

@heskew
Copy link
Copy Markdown
Member

@heskew heskew commented Jan 26, 2026

Resolves #118 and #119

@heskew heskew marked this pull request as ready for review January 26, 2026 16:43
@heskew heskew requested a review from a team as a code owner January 26, 2026 16:43
Copy link
Copy Markdown
Contributor

@cb1kenobi cb1kenobi left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

Comment thread integrationTests/utils/securityServices.ts Outdated
Comment thread integrationTests/utils/securityServices.ts Outdated
Copy link
Copy Markdown
Member

@Ethan-Arrowood Ethan-Arrowood left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is looking great. Love to see some extensive use of the new integration testing framework.

I'm most concerned with two things:

  1. configurable ports (can introduce major flakiness)
  2. Assertions seem to be okay with 200, 400, and other status codes. Unless it really is random or undetermined, these scenarios feel like specific cases we should be asserting for. What would cause a request to sometimes 200 and other times 400 when it comes to certificate verification? Seems suspicious to me, but maybe there is something to all of that I'm not aware of or considering.

Finally, is there any additional documentation for the new utils (or tests) that needs to be added to the integration testing docs content?

Comment thread integrationTests/utils/securityServices.ts Outdated
Comment thread integrationTests/utils/security/crl/generate-test-certs.ts Outdated
Comment thread integrationTests/utils/security/ocsp/generate-test-certs.ts Outdated
Comment thread integrationTests/utils/security/ocsp/generate-test-certs.ts Outdated
Comment thread integrationTests/utils/securityServices.ts Outdated
Comment thread integrationTests/security/ocsp-verification.test.ts Outdated
Comment thread integrationTests/security/ocsp-verification.test.ts Outdated
Comment thread integrationTests/security/ocsp-verification.test.ts Outdated
Comment thread integrationTests/security/ocsp-verification.test.ts Outdated
Comment thread integrationTests/security/ocsp-verification.test.ts Outdated
@heskew heskew marked this pull request as draft January 28, 2026 22:38
@heskew
Copy link
Copy Markdown
Member Author

heskew commented Jan 28, 2026

@Ethan-Arrowood thanks for all the feedback! I'll get back to this soon - head's down on something else. RE response codes I've cared more about 'access denied' vs 'okay-ish'. I have no problem refining these tests though to catch any potential false passes.

Copy link
Copy Markdown
Member

@kriszyp kriszyp left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I haven't looked at the details and trust you are sorting that out, but I certainly approve at a high-level.

@heskew heskew force-pushed the cert-verification-integration-tests branch 7 times, most recently from f23bf1a to 5f3dc41 Compare February 3, 2026 18:59
@Ethan-Arrowood
Copy link
Copy Markdown
Member

Just took a read through your replies. Sounds like you're on a much better track now. I'll wait until you mark this as ready for review before going through the code again.

@heskew heskew force-pushed the cert-verification-integration-tests branch from 3efea32 to 9ce6ab2 Compare February 4, 2026 00:07
@heskew heskew marked this pull request as ready for review February 4, 2026 11:50
@heskew
Copy link
Copy Markdown
Member Author

heskew commented Feb 4, 2026

@Ethan-Arrowood - please give this another look whenever you get a chance

@Ethan-Arrowood
Copy link
Copy Markdown
Member

Sorry for the delay; can you fix the conflicts before I review?

@heskew heskew force-pushed the cert-verification-integration-tests branch 2 times, most recently from 1b5fb69 to a10e938 Compare February 27, 2026 17:03
@heskew heskew marked this pull request as draft February 27, 2026 19:08
@heskew heskew force-pushed the cert-verification-integration-tests branch 2 times, most recently from b01e519 to 1747c1c Compare March 25, 2026 21:44
@heskew heskew marked this pull request as ready for review March 26, 2026 01:30
@heskew
Copy link
Copy Markdown
Member Author

heskew commented Mar 26, 2026

Sorry for the delay; can you fix the conflicts before I review?

@Ethan-Arrowood no worries and you've been super busy with other things. rebased and addressed an edge case that surfaced during testing.

Copy link
Copy Markdown
Member

@Ethan-Arrowood Ethan-Arrowood left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is looking good. The only thing is it seems like you have a bad merge here. This is adding back things removed from harperLifecycle.ts previously. Fix that and then I think you're good to go.

Comment thread integrationTests/security/crl-verification.test.ts
Comment thread integrationTests/utils/security/certGenUtils.ts Outdated
Comment thread integrationTests/utils/harperLifecycle.ts Outdated
);
const dataRootDir = await mkdtemp(dataRootDirPrefix);
await cp(fixturePath, join(dataRootDir, 'components', basename(fixturePath)), { recursive: true });
(ctx as any).harper = { dataRootDir };
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
(ctx as any).harper = { dataRootDir };
ctx.harper = { dataRootDir };

This should be fine?

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Type '{ dataRootDir: string; }' is missing the following properties from type 'HarperContext': admin, httpURL, operationsAPIURL, hostname, process

@heskew heskew merged commit 338b404 into main Apr 5, 2026
22 checks passed
@heskew heskew deleted the cert-verification-integration-tests branch April 5, 2026 14:02
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Enable OCSP and CRL certificate verification tests in CI

4 participants