tasks: decompose phases 0-1 of crate extraction into implementation tasks
Phase 0 (core/connection-credentials): purely additive — add ConnectionCredentials + RemoteIdentity to alknet-core. No call crate changes. ~40 lines, zero breakage. Phase 1 (tls/*): greenfield alknet-tls crate in 5 tasks: - tls/crate-init: Cargo.toml, deps, module skeleton - tls/server-extract: TlsServerConfig + server TLS code from endpoint.rs - tls/client-extract: TlsClientConfig + client TLS code from call_client.rs - tls/tests: 32 TLS tests moved and adapted - tls/review-tls: phase gate review checkpoint All old code stays duplicated — purely additive phases. Prunes in 4-5.
This commit is contained in:
deepseek-v4-pro committed
1 parent
e91d943857
commit
4ced71f44a
6 files changed
+815
No files matched your search
@@ -0,0 +1,177 @@
|
||||
---
|
||||
id: core/connection-credentials
|
||||
name: Add ConnectionCredentials + RemoteIdentity to alknet-core (purely additive)
|
||||
status: pending
|
||||
depends_on: []
|
||||
scope: narrow
|
||||
risk: low
|
||||
impact: component
|
||||
level: implementation
|
||||
---
|
||||
|
||||
## Description
|
||||
|
||||
Phase 0 of the crate extraction (per `docs/research/alknet-crate-extraction/findings.md`).
|
||||
Add `ConnectionCredentials` + `RemoteIdentity` to a new `crates/alknet-core/src/credentials.rs`.
|
||||
This is **purely additive** — core gains two small types, nothing else changes, no breakage.
|
||||
|
||||
`ConnectionCredentials` is the transport-level credential bundle (ADR-091) — it carries
|
||||
`tls_identity` + `remote_identity` (the two dimensions the dial consumes). It is the
|
||||
transport-level equivalent of `CallCredentials` (which lives in `alknet-call` and carries
|
||||
an additional `auth_token` field). `ConnectionCredentials` is what `alknet-client` (Phase 3)
|
||||
and `alknet-tls` (Phase 1) will consume — the dep graph is clean from the start, with no
|
||||
temporary dep on `alknet-call`.
|
||||
|
||||
`alknet-call` is **not touched** in this phase. Its `CallCredentials` + `RemoteIdentity`
|
||||
stay as-is. The call crate refactor (removing `CallCredentials`, importing from core,
|
||||
moving tests) happens in Phase 5 when the full prune is done. This keeps Phase 0 truly
|
||||
additive and avoids touching tests that may be removed later.
|
||||
|
||||
### Step 1: Create `crates/alknet-core/src/credentials.rs`
|
||||
|
||||
New file with two types:
|
||||
|
||||
```rust
|
||||
//! Transport-level credential bundle for outbound connections (ADR-091).
|
||||
//!
|
||||
//! `ConnectionCredentials` carries the two dimensions the dial consumes:
|
||||
//! the local node's TLS identity and the expected remote identity.
|
||||
//! It is transport-agnostic — consumed by `alknet-tls` (TLS setup) and
|
||||
//! `alknet-client` (dial).
|
||||
|
||||
use crate::config::TlsIdentity;
|
||||
|
||||
/// Expected identity of the remote node (ADR-017 §7, extended by ADR-034 §2).
|
||||
///
|
||||
/// Carries a fingerprint string the assembly layer derives from `Capabilities`
|
||||
/// when the local node has a `PeerEntry` for the remote (the known-peer case →
|
||||
/// fingerprint pin).
|
||||
///
|
||||
/// `remote_identity: None` is the **public X.509 endpoint** case: the local
|
||||
/// node has no `PeerEntry` for the remote, so there is no fingerprint to pin.
|
||||
/// Combined with an X.509 transport, `None` selects CA verification
|
||||
/// (`WebPkiServerVerifier`) per the verifier-selection rule in ADR-034 §3.
|
||||
/// Combined with an Ed25519 raw-key transport, `None` fails closed (raw-key
|
||||
/// remotes are always known peers — no CA to fall back to).
|
||||
///
|
||||
/// The `Option` is therefore load-bearing, not cosmetic: `Some(fingerprint)`
|
||||
/// means "pin this" (known peer), `None` means "trust the CA or fail"
|
||||
/// (unknown remote). An implementer must not default `remote_identity` to a
|
||||
/// placeholder value to "satisfy" the field — `None` is a real state that
|
||||
/// drives verifier selection.
|
||||
#[derive(Debug, Clone)]
|
||||
pub struct RemoteIdentity {
|
||||
pub fingerprint: String,
|
||||
}
|
||||
|
||||
/// Credentials for an outbound connection (ADR-091). All dimensions come from
|
||||
/// `Capabilities` (ADR-014), never from environment variables — see the
|
||||
/// No-Env-Vars Invariant in
|
||||
/// `docs/architecture/crates/call/client-and-adapters.md`.
|
||||
#[derive(Debug, Clone, Default)]
|
||||
pub struct ConnectionCredentials {
|
||||
/// The local node's TLS identity (RFC 7250 raw key or X.509), derived
|
||||
/// from the vault at startup.
|
||||
pub tls_identity: Option<TlsIdentity>,
|
||||
/// Expected fingerprint/cert of the remote node, stored as a capability.
|
||||
/// `Some` → fingerprint pin (known peer with a `PeerEntry`); `None` → CA
|
||||
/// verification for X.509 remotes, fail-closed for Ed25519 raw-key remotes
|
||||
/// (ADR-034 §2/§3). `None` is the public-X.509-endpoint state, not a
|
||||
/// missing field — must not be defaulted to a placeholder.
|
||||
pub remote_identity: Option<RemoteIdentity>,
|
||||
}
|
||||
|
||||
impl ConnectionCredentials {
|
||||
pub fn new() -> Self {
|
||||
Self::default()
|
||||
}
|
||||
|
||||
pub fn with_tls_identity(mut self, tls_identity: TlsIdentity) -> Self {
|
||||
self.tls_identity = Some(tls_identity);
|
||||
self
|
||||
}
|
||||
|
||||
pub fn with_remote_identity(mut self, remote: RemoteIdentity) -> Self {
|
||||
self.remote_identity = Some(remote);
|
||||
self
|
||||
}
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::*;
|
||||
|
||||
#[test]
|
||||
fn connection_credentials_builder_methods() {
|
||||
let creds = ConnectionCredentials::new().with_remote_identity(RemoteIdentity {
|
||||
fingerprint: "SHA256:abc".to_string(),
|
||||
});
|
||||
assert_eq!(
|
||||
creds.remote_identity.as_ref().unwrap().fingerprint,
|
||||
"SHA256:abc"
|
||||
);
|
||||
assert!(creds.tls_identity.is_none());
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn connection_credentials_none_is_load_bearing_not_defaulted() {
|
||||
let creds = ConnectionCredentials::new();
|
||||
assert!(
|
||||
creds.remote_identity.is_none(),
|
||||
"ConnectionCredentials::new() must keep remote_identity as None (the load-bearing \
|
||||
public-X.509-endpoint state), not default it to a placeholder"
|
||||
);
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
### Step 2: Update `alknet-core/src/lib.rs`
|
||||
|
||||
Add `pub mod credentials;` and re-export the types:
|
||||
|
||||
```rust
|
||||
pub mod credentials;
|
||||
// ... existing modules ...
|
||||
|
||||
pub use credentials::{ConnectionCredentials, RemoteIdentity};
|
||||
```
|
||||
|
||||
### What does NOT change
|
||||
|
||||
- `alknet-call` — completely untouched. `CallCredentials` + `RemoteIdentity` stay as-is.
|
||||
- `endpoint.rs` — unchanged.
|
||||
- All existing tests — unchanged.
|
||||
|
||||
## Acceptance Criteria
|
||||
|
||||
- [ ] `crates/alknet-core/src/credentials.rs` exists with `ConnectionCredentials` + `RemoteIdentity` as specified
|
||||
- [ ] `ConnectionCredentials` has `tls_identity` and `remote_identity` fields (no `auth_token`)
|
||||
- [ ] `ConnectionCredentials` has `new()`, `with_tls_identity()`, `with_remote_identity()` builder methods
|
||||
- [ ] `alknet-core/src/lib.rs` has `pub mod credentials;` and re-exports both types
|
||||
- [ ] Unit tests for `ConnectionCredentials` builder and `None`-is-load-bearing invariant pass
|
||||
- [ ] `cargo test -p alknet-core` passes (all feature combos)
|
||||
- [ ] `cargo test --workspace` passes (no regressions)
|
||||
- [ ] `cargo clippy --workspace` passes with no warnings
|
||||
- [ ] `cargo fmt --check --workspace` passes
|
||||
|
||||
## References
|
||||
|
||||
- docs/research/alknet-crate-extraction/findings.md — Phase 0
|
||||
- docs/architecture/decisions/091-connection-credentials.md — ADR-091 (amended 2026-07-17)
|
||||
- docs/architecture/decisions/034-outgoing-only-x509-and-three-peer-roles.md — ADR-034
|
||||
- crates/alknet-call/src/client/call_client.rs — current `CallCredentials` + `RemoteIdentity` definitions (reference for field shapes)
|
||||
|
||||
## Notes
|
||||
|
||||
> This is Phase 0 of the crate extraction — the smallest and most independent
|
||||
> phase. ~40 lines of new code in core, zero changes anywhere else. Purely
|
||||
> additive — `alknet-call` is not touched. The field name stays `tls_identity`
|
||||
> (not `local_identity`) to match the existing code and avoid unnecessary churn
|
||||
> — the rename can happen later if desired. `ConnectionCredentials` has no
|
||||
> `auth_token` field because `auth_token` is a per-request payload field, not a
|
||||
> transport-level credential (ADR-091). The call crate refactor (removing
|
||||
> `CallCredentials`, importing from core, moving tests) happens in Phase 5.
|
||||
|
||||
## Summary
|
||||
|
||||
> To be filled on completion
|
||||
@@ -0,0 +1,129 @@
|
||||
---
|
||||
id: tls/client-extract
|
||||
name: Extract client-side TLS code from alknet-call/call_client.rs into alknet-tls
|
||||
status: pending
|
||||
depends_on: [tls/server-extract]
|
||||
scope: narrow
|
||||
risk: medium
|
||||
impact: component
|
||||
level: implementation
|
||||
---
|
||||
|
||||
## Description
|
||||
|
||||
Phase 1, Task 3 of the crate extraction. Extract the client-side TLS setup code from
|
||||
`crates/alknet-call/src/client/call_client.rs` (lines 189-320) into
|
||||
`crates/alknet-tls/src/client.rs`. Reuse the shared `Ed25519SigningKey` from
|
||||
`signing.rs` and `load_cert_chain`/`load_private_key` from `pem.rs` (already extracted
|
||||
in the previous task).
|
||||
|
||||
The old code **stays** in `call_client.rs` (duplicated) — no breakage. The new crate is
|
||||
self-contained and builds standalone.
|
||||
|
||||
### Types to extract
|
||||
|
||||
From `call_client.rs` lines 189-320:
|
||||
|
||||
| Type/Function | Lines | Destination |
|
||||
|---------------|-------|-------------|
|
||||
| `build_quinn_client_config()` | 189-211 | `client.rs` |
|
||||
| `build_client_auth()` | 213-246 | `client.rs` |
|
||||
| `select_server_verifier()` | 248-278 | `client.rs` |
|
||||
| `load_platform_root_cert_store()` | 280-297 | `client.rs` |
|
||||
| `load_cert_chain()` | 299-308 | **skip** — already in `pem.rs` from server-extract |
|
||||
| `load_private_key()` | 310-321 | **skip** — already in `pem.rs` from server-extract |
|
||||
|
||||
Also extract from `call_client.rs` lines 323-567 (the struct impls):
|
||||
|
||||
| Type/Function | Lines | Destination |
|
||||
|---------------|-------|-------------|
|
||||
| `RawKeyClientCertResolver` struct + impls | 323-374 | `client.rs` |
|
||||
| `NoClientCertResolver` struct + impls | 376-403 | `client.rs` |
|
||||
| `FingerprintPinVerifier` struct + impls | 405-507 | `client.rs` |
|
||||
| `Ed25519SigningKey` struct + impls | 509-567 | **skip** — already in `signing.rs` from server-extract |
|
||||
|
||||
### New public API type
|
||||
|
||||
Wrap the extracted client-side code in a public API type:
|
||||
|
||||
```rust
|
||||
// client.rs
|
||||
|
||||
/// Client-side TLS configuration, transport-agnostic.
|
||||
/// Wraps a `rustls::ClientConfig` built from `ConnectionCredentials`.
|
||||
pub struct TlsClientConfig {
|
||||
pub(crate) rustls_config: rustls::ClientConfig,
|
||||
}
|
||||
|
||||
impl TlsClientConfig {
|
||||
/// Build a client config from `ConnectionCredentials` and an ALPN.
|
||||
/// Selects the server cert verifier by `remote_identity` presence
|
||||
/// (ADR-034 §3): `Some` → fingerprint pin, `None` → CA verification.
|
||||
pub fn new(
|
||||
credentials: &alknet_core::credentials::ConnectionCredentials,
|
||||
alpn: &[u8],
|
||||
) -> Result<Self, TlsError> { ... }
|
||||
|
||||
/// Convert to a `quinn::ClientConfig` for QUIC transport.
|
||||
#[cfg(feature = "quinn")]
|
||||
pub fn for_quinn(self) -> Result<quinn::ClientConfig, TlsError> { ... }
|
||||
}
|
||||
```
|
||||
|
||||
### Adaptations
|
||||
|
||||
1. **Error types**: Replace `String` error returns with `TlsError`. The current code returns
|
||||
`Result<_, String>` from most functions — convert to `Result<_, TlsError>`.
|
||||
2. **Imports**: Update `alknet_core::config::*` and `alknet_core::fingerprint::*` imports.
|
||||
Use `crate::signing::Ed25519SigningKey` (not a local copy).
|
||||
Use `crate::pem::load_cert_chain` / `crate::pem::load_private_key` (not local copies).
|
||||
3. **`load_platform_root_cert_store`**: Add the `webpki-roots` fallback (ADR-088 §5) —
|
||||
when the platform store is empty, merge built-in `webpki-roots` so `NoRootAnchors` is
|
||||
unreachable in practice. This is new code, not extracted.
|
||||
4. **`FingerprintPinVerifier`**: The `verify_tls12_signature` and `verify_tls13_signature`
|
||||
methods use `alknet_core::fingerprint::extract_ed25519_raw_key_from_spki` — keep that
|
||||
import.
|
||||
5. **Feature gates**: All client-side TLS code is gated on `#[cfg(feature = "quinn")]`.
|
||||
The `TlsClientConfig::new()` constructor itself is **not** feature-gated (it builds a
|
||||
`rustls::ClientConfig`, which is transport-agnostic). Only `for_quinn()` is gated.
|
||||
|
||||
### What stays in call
|
||||
|
||||
The old code in `call_client.rs` lines 189-567 is **not deleted** — it stays as a duplicate.
|
||||
The prune happens in Phase 5. This task only adds code to `alknet-tls`.
|
||||
|
||||
## Acceptance Criteria
|
||||
|
||||
- [ ] `crates/alknet-tls/src/client.rs` contains `TlsClientConfig`, `build_quinn_client_config` (as `TlsClientConfig::new`), `build_client_auth`, `select_server_verifier`, `load_platform_root_cert_store`, `FingerprintPinVerifier`, `RawKeyClientCertResolver`, `NoClientCertResolver`
|
||||
- [ ] `TlsClientConfig::new()` accepts `&ConnectionCredentials` + `&[u8]` and returns `Result<Self, TlsError>`
|
||||
- [ ] `TlsClientConfig::for_quinn()` converts to `quinn::ClientConfig` (feature-gated)
|
||||
- [ ] `load_platform_root_cert_store` includes `webpki-roots` fallback (ADR-088 §5)
|
||||
- [ ] Client code uses `crate::signing::Ed25519SigningKey` (not a local copy)
|
||||
- [ ] Client code uses `crate::pem::load_cert_chain` / `crate::pem::load_private_key` (not local copies)
|
||||
- [ ] All error returns use `TlsError` (not `String`)
|
||||
- [ ] Feature gates correct: `quinn` for `for_quinn()` and quinn-specific helpers
|
||||
- [ ] `cargo check -p alknet-tls` succeeds (all feature combos)
|
||||
- [ ] `cargo clippy -p alknet-tls` succeeds with no warnings
|
||||
- [ ] `cargo test -p alknet-core` still passes (old code untouched)
|
||||
- [ ] `cargo test -p alknet-call` still passes (old code untouched)
|
||||
|
||||
## References
|
||||
|
||||
- docs/research/alknet-crate-extraction/findings.md — Phase 1, client-side extraction
|
||||
- docs/architecture/decisions/088-webpki-roots-fallback.md — ADR-088 §5
|
||||
- docs/architecture/decisions/034-outgoing-only-x509-and-three-peer-roles.md — ADR-034 §3
|
||||
- crates/alknet-call/src/client/call_client.rs — lines 189-567 (source code to extract)
|
||||
- crates/alknet-core/src/fingerprint.rs — `extract_ed25519_raw_key_from_spki`, `fingerprint_from_cert_der`
|
||||
|
||||
## Notes
|
||||
|
||||
> This is the smaller extraction (~130 lines of implementation). The main work
|
||||
> is adapting error types (String → TlsError) and reusing the shared
|
||||
> `Ed25519SigningKey` and `load_cert_chain`/`load_private_key` from the
|
||||
> server-extract task. The `webpki-roots` fallback in `load_platform_root_cert_store`
|
||||
> is new code (not extracted) per ADR-088 §5. The old code in `call_client.rs` is
|
||||
> NOT deleted — that's Phase 5.
|
||||
|
||||
## Summary
|
||||
|
||||
> To be filled on completion
|
||||
@@ -0,0 +1,118 @@
|
||||
---
|
||||
id: tls/crate-init
|
||||
name: Initialize alknet-tls crate with Cargo.toml, dependencies, and module skeleton
|
||||
status: pending
|
||||
depends_on: [core/connection-credentials]
|
||||
scope: moderate
|
||||
risk: low
|
||||
impact: project
|
||||
level: implementation
|
||||
---
|
||||
|
||||
## Description
|
||||
|
||||
Phase 1, Task 1 of the crate extraction (per `docs/research/alknet-crate-extraction/findings.md`).
|
||||
Initialize the `alknet-tls` crate from scratch. This crate provides TLS setup types for both
|
||||
server-side and client-side — `TlsServerConfig`, `TlsClientConfig`, `TlsError`, and the shared
|
||||
TLS helpers (`Ed25519SigningKey`, cert/key loaders, verifiers, cert resolvers).
|
||||
|
||||
### Crate setup
|
||||
|
||||
Create `crates/alknet-tls/` with:
|
||||
|
||||
- `Cargo.toml` — package metadata, dependencies, feature flags
|
||||
- `src/lib.rs` — crate root with module declarations and re-exports
|
||||
- Module skeleton files for:
|
||||
- `src/server.rs` — `TlsServerConfig`, `build_rustls_server_config`, `RawKeyCertResolver`, `AcceptAnyCertVerifier`, `SelfSignedCert`, `generate_self_signed_cert`, `TlsSetup` (extracted from `endpoint.rs` lines 493-934)
|
||||
- `src/client.rs` — `TlsClientConfig`, `build_quinn_client_config`, `build_client_auth`, `select_server_verifier`, `FingerprintPinVerifier`, `RawKeyClientCertResolver`, `NoClientCertResolver`, `load_platform_root_cert_store` (extracted from `call_client.rs` lines 189-320)
|
||||
- `src/signing.rs` — `Ed25519SigningKey` (consolidated — one copy, used by both server + client)
|
||||
- `src/pem.rs` — `load_cert_chain`, `load_private_key` (consolidated — one copy, used by both server + client)
|
||||
|
||||
### Dependencies
|
||||
|
||||
Per the findings (Phase 1):
|
||||
|
||||
| Crate | Purpose |
|
||||
|-------|---------|
|
||||
| `alknet-core` | `TlsIdentity`, `Ed25519SecretKey`, `fingerprint` (workspace path) |
|
||||
| `rustls` 0.23 | TLS implementation (aws-lc-rs) |
|
||||
| `rustls-pemfile` 2 | PEM cert/key loading |
|
||||
| `rustls-native-certs` 0.8 | Platform root CA store |
|
||||
| `webpki-roots` | Built-in root CA fallback (new — not extracted) |
|
||||
| `rcgen` 0.13 | Self-signed cert generation |
|
||||
| `tokio` 1 (full) | Async runtime |
|
||||
| `quinn` 0.11 | QUIC transport (optional, feature-gated) |
|
||||
| `tokio-rustls` 0.26 | TCP+TLS transport (optional, feature-gated) |
|
||||
| `rustls-acme` 0.12 | ACME cert provisioning (optional, feature-gated) |
|
||||
| `tracing` 0.1 | Structured logging |
|
||||
| `thiserror` 2 | Error enums |
|
||||
|
||||
`rustls-native-certs` and `webpki-roots` are **always-present (not feature-gated)** — the
|
||||
unknown-X.509-remote CA-verification path in `TlsClientConfig::new` is transport-agnostic;
|
||||
the `webpki-roots` fallback merges built-in roots when the platform store is empty so
|
||||
`NoRootAnchors` is unreachable in practice (ADR-088 §5).
|
||||
|
||||
### Feature flags
|
||||
|
||||
```toml
|
||||
[features]
|
||||
default = ["quinn"]
|
||||
quinn = ["dep:quinn"]
|
||||
tcp = ["dep:tokio-rustls"]
|
||||
acme = ["dep:rustls-acme"]
|
||||
```
|
||||
|
||||
### Workspace Cargo.toml
|
||||
|
||||
Add `crates/alknet-tls` to the workspace `members` list in the root `Cargo.toml`.
|
||||
|
||||
### Module skeleton
|
||||
|
||||
```rust
|
||||
// src/lib.rs
|
||||
//! alknet-tls: TLS setup types for alknet — server config, client config,
|
||||
//! verifiers, cert resolvers, and shared signing helpers.
|
||||
//!
|
||||
//! Provides `TlsServerConfig` (server-side TLS setup) and `TlsClientConfig`
|
||||
//! (client-side TLS setup), both transport-agnostic. Transport-specific
|
||||
//! conversion (e.g. `for_quinn()`) is feature-gated.
|
||||
|
||||
pub mod client;
|
||||
pub mod pem;
|
||||
pub mod server;
|
||||
pub mod signing;
|
||||
|
||||
// Re-exports (filled in by subsequent tasks)
|
||||
```
|
||||
|
||||
Each module file gets a doc comment and `// TODO: implement` marker.
|
||||
|
||||
## Acceptance Criteria
|
||||
|
||||
- [ ] `crates/alknet-tls/Cargo.toml` exists with all dependencies and feature flags
|
||||
- [ ] `crates/alknet-tls/src/lib.rs` exists with module declarations
|
||||
- [ ] Module skeleton files exist: `server.rs`, `client.rs`, `signing.rs`, `pem.rs`
|
||||
- [ ] Root `Cargo.toml` `members` list includes `crates/alknet-tls`
|
||||
- [ ] `cargo check -p alknet-tls` succeeds
|
||||
- [ ] `cargo clippy -p alknet-tls` succeeds with no warnings
|
||||
- [ ] Dual licensing: `MIT OR Apache-2.0` (workspace-inherited)
|
||||
- [ ] `alknet-core` dependency uses workspace path (`path = "../alknet-core"`)
|
||||
|
||||
## References
|
||||
|
||||
- docs/research/alknet-crate-extraction/findings.md — Phase 1
|
||||
- docs/architecture/decisions/088-webpki-roots-fallback.md — ADR-088 §5
|
||||
- crates/alknet-core/Cargo.toml — reference for dep versions
|
||||
- crates/alknet-call/Cargo.toml — reference for dep versions
|
||||
|
||||
## Notes
|
||||
|
||||
> This is the foundational setup task for alknet-tls. All subsequent tls/*
|
||||
> tasks depend on this one. The crate has no alknet dependencies beyond core.
|
||||
> `rustls-native-certs` and `webpki-roots` are always-present (not feature-gated)
|
||||
> per ADR-088 §5. The `quinn`/`tcp`/`acme` features gate transport-specific
|
||||
> conversion methods, not the core TLS types.
|
||||
|
||||
## Summary
|
||||
|
||||
> To be filled on completion
|
||||
@@ -0,0 +1,112 @@
|
||||
---
|
||||
id: tls/review-tls
|
||||
name: Review alknet-tls implementation for spec conformance, deduplication, and test coverage
|
||||
status: pending
|
||||
depends_on: [tls/tests]
|
||||
scope: moderate
|
||||
risk: low
|
||||
impact: phase
|
||||
level: review
|
||||
---
|
||||
|
||||
## Description
|
||||
|
||||
Phase 1 review checkpoint. Verify the `alknet-tls` crate is spec-conformant,
|
||||
self-contained, and ready for downstream consumption by `alknet-endpoint` (Phase 2)
|
||||
and `alknet-client` (Phase 3).
|
||||
|
||||
### Review Checklist
|
||||
|
||||
1. **Crate structure**:
|
||||
- Module layout matches spec: `server.rs`, `client.rs`, `signing.rs`, `pem.rs`
|
||||
- Public API types: `TlsServerConfig`, `TlsClientConfig`, `TlsError`, `Ed25519SigningKey`
|
||||
- Re-exports in `lib.rs` are correct and minimal
|
||||
|
||||
2. **Server-side conformance**:
|
||||
- `TlsServerConfig::new()` accepts `&TlsIdentity` + `&[Vec<u8>]` and returns `Result<Self, TlsError>`
|
||||
- `TlsServerConfig::for_quinn()` converts to `quinn::ServerConfig` (feature-gated)
|
||||
- `RawKeyCertResolver` implements `ResolvesServerCert` with `only_raw_public_keys() == true`
|
||||
- `AcceptAnyCertVerifier` implements `ClientCertVerifier` in "request-but-don't-require" mode
|
||||
- `SelfSignedCert` generation uses `rcgen`
|
||||
- ACME path (`TlsSetup::new_acme`) is feature-gated on `acme`
|
||||
- `build_iroh_endpoint` is either extracted (feature-gated on `iroh`) or deferred with a TODO
|
||||
|
||||
3. **Client-side conformance**:
|
||||
- `TlsClientConfig::new()` accepts `&ConnectionCredentials` + `&[u8]` and returns `Result<Self, TlsError>`
|
||||
- `TlsClientConfig::for_quinn()` converts to `quinn::ClientConfig` (feature-gated)
|
||||
- `FingerprintPinVerifier` implements `ServerCertVerifier` with fingerprint matching
|
||||
- `select_server_verifier` logic: `Some` → fingerprint pin, `None` → CA verification (ADR-034 §3)
|
||||
- `RawKeyClientCertResolver` implements `ResolvesClientCert` with `only_raw_public_keys()` detection
|
||||
- `NoClientCertResolver` implements `ResolvesClientCert` with `has_certs() == false`
|
||||
- `load_platform_root_cert_store` includes `webpki-roots` fallback (ADR-088 §5)
|
||||
|
||||
4. **Shared code deduplication**:
|
||||
- `Ed25519SigningKey` is defined once in `signing.rs`, used by both server and client
|
||||
- `load_cert_chain` / `load_private_key` are defined once in `pem.rs`, used by both
|
||||
- No duplicate `Ed25519SigningKey` or PEM loaders between server and client modules
|
||||
|
||||
5. **Dependency hygiene**:
|
||||
- `rustls-native-certs` and `webpki-roots` are always-present (not feature-gated) per ADR-088 §5
|
||||
- `quinn` is optional, gated behind `quinn` feature
|
||||
- `tokio-rustls` is optional, gated behind `tcp` feature
|
||||
- `rustls-acme` is optional, gated behind `acme` feature
|
||||
- No unexpected heavy deps
|
||||
|
||||
6. **Error handling**:
|
||||
- `TlsError` has `Config`, `Io`, `Cert` variants
|
||||
- All public fallible functions return `Result<_, TlsError>` (no raw `String` errors)
|
||||
- Error messages are descriptive
|
||||
|
||||
7. **Test coverage**:
|
||||
- All 22 server-side tests pass
|
||||
- All 10 client-side tests pass
|
||||
- `Ed25519SigningKey` tests (6) pass
|
||||
- PEM loader tests (3) pass
|
||||
- Tests exercise error paths (missing files, wrong fingerprints, etc.)
|
||||
- Feature-gated tests are correctly annotated
|
||||
|
||||
8. **Cross-cutting checks**:
|
||||
- `cargo build -p alknet-tls` succeeds (all feature combos)
|
||||
- `cargo test -p alknet-tls` succeeds (all feature combos)
|
||||
- `cargo clippy -p alknet-tls --all-targets` succeeds with no warnings
|
||||
- `cargo fmt --check -p alknet-tls` passes
|
||||
- `cargo build --workspace` still succeeds (old code untouched)
|
||||
- `cargo test --workspace` still succeeds (old tests untouched)
|
||||
|
||||
## Acceptance Criteria
|
||||
|
||||
- [ ] Crate structure matches spec (4 modules, public API types)
|
||||
- [ ] `TlsServerConfig` API correct and feature-gated
|
||||
- [ ] `TlsClientConfig` API correct and feature-gated
|
||||
- [ ] `Ed25519SigningKey` deduplicated (one copy in `signing.rs`)
|
||||
- [ ] `load_cert_chain` / `load_private_key` deduplicated (one copy in `pem.rs`)
|
||||
- [ ] `webpki-roots` fallback present in `load_platform_root_cert_store`
|
||||
- [ ] `rustls-native-certs` + `webpki-roots` always-present (not feature-gated)
|
||||
- [ ] All 41 tests pass (22 server + 10 client + 6 signing + 3 pem)
|
||||
- [ ] `cargo build -p alknet-tls` succeeds (all feature combos)
|
||||
- [ ] `cargo test -p alknet-tls` succeeds (all feature combos)
|
||||
- [ ] `cargo clippy -p alknet-tls --all-targets` succeeds with no warnings
|
||||
- [ ] `cargo fmt --check -p alknet-tls` passes
|
||||
- [ ] Workspace still green: `cargo build --workspace` + `cargo test --workspace` pass
|
||||
|
||||
## References
|
||||
|
||||
- docs/research/alknet-crate-extraction/findings.md — Phase 1
|
||||
- docs/architecture/decisions/088-webpki-roots-fallback.md — ADR-088 §5
|
||||
- docs/architecture/decisions/034-outgoing-only-x509-and-three-peer-roles.md — ADR-034 §3
|
||||
- tasks/tls/crate-init.md
|
||||
- tasks/tls/server-extract.md
|
||||
- tasks/tls/client-extract.md
|
||||
- tasks/tls/tests.md
|
||||
|
||||
## Notes
|
||||
|
||||
> This review gates Phase 1 completion. The crate must be self-contained and
|
||||
> spec-conformant before Phase 2 (`alknet-endpoint`) and Phase 3 (`alknet-client`)
|
||||
> begin, since both depend on `alknet-tls`. The old code in core and call is
|
||||
> intentionally still present (duplicated) — the prunes happen in Phases 4-5.
|
||||
> If deviations are found, document and fix before proceeding to Phase 2.
|
||||
|
||||
## Summary
|
||||
|
||||
> To be filled on completion
|
||||
@@ -0,0 +1,153 @@
|
||||
---
|
||||
id: tls/server-extract
|
||||
name: Extract server-side TLS code from alknet-core/endpoint.rs into alknet-tls
|
||||
status: pending
|
||||
depends_on: [tls/crate-init]
|
||||
scope: moderate
|
||||
risk: medium
|
||||
impact: component
|
||||
level: implementation
|
||||
---
|
||||
|
||||
## Description
|
||||
|
||||
Phase 1, Task 2 of the crate extraction. Extract the server-side TLS setup code from
|
||||
`crates/alknet-core/src/endpoint.rs` (lines 493-934) into `crates/alknet-tls/src/server.rs`
|
||||
and `crates/alknet-tls/src/signing.rs` + `crates/alknet-tls/src/pem.rs` (shared helpers).
|
||||
|
||||
The old code **stays** in `endpoint.rs` (duplicated) — no breakage. The new crate is
|
||||
self-contained and builds standalone.
|
||||
|
||||
### Types to extract
|
||||
|
||||
From `endpoint.rs` lines 493-934:
|
||||
|
||||
| Type/Function | Lines | Destination |
|
||||
|---------------|-------|-------------|
|
||||
| `TlsSetup` struct + `new()` + `new_acme()` | 493-611 | `server.rs` |
|
||||
| `build_quinn_server_config_from_rustls()` | 614-624 | `server.rs` |
|
||||
| `build_rustls_server_config()` | 626-674 | `server.rs` |
|
||||
| `build_iroh_endpoint()` | 676-703 | `server.rs` (feature-gated on `iroh`) |
|
||||
| `load_cert_chain()` | 705-714 | `pem.rs` (shared) |
|
||||
| `load_private_key()` | 716-730 | `pem.rs` (shared) |
|
||||
| `SelfSignedCert` struct | 732-736 | `server.rs` |
|
||||
| `generate_self_signed_cert()` | 738-755 | `server.rs` |
|
||||
| `AcceptAnyCertVerifier` struct + impls | 757-834 | `server.rs` |
|
||||
| `RawKeyCertResolver` struct + impls | 836-873 | `server.rs` |
|
||||
| `Ed25519SigningKey` struct + impls | 875-933 | `signing.rs` (shared) |
|
||||
|
||||
### New public API types
|
||||
|
||||
The extracted code currently uses free functions and private structs. Wrap them in
|
||||
public API types for the crate:
|
||||
|
||||
```rust
|
||||
// server.rs
|
||||
|
||||
/// Server-side TLS configuration, transport-agnostic.
|
||||
/// Wraps a `rustls::ServerConfig` plus optional ACME state.
|
||||
pub struct TlsServerConfig {
|
||||
pub(crate) rustls_config: rustls::ServerConfig,
|
||||
#[cfg(feature = "acme")]
|
||||
pub(crate) acme_state_handle: Option<tokio::task::JoinHandle<()>>,
|
||||
}
|
||||
|
||||
impl TlsServerConfig {
|
||||
/// Build a server config from a `TlsIdentity` and ALPN list.
|
||||
/// ACME identities spawn a background cert-renewal task.
|
||||
pub async fn new(
|
||||
tls_identity: &alknet_core::config::TlsIdentity,
|
||||
alpns: &[Vec<u8>],
|
||||
) -> Result<Self, TlsError> { ... }
|
||||
|
||||
/// Convert to a `quinn::ServerConfig` for QUIC transport.
|
||||
#[cfg(feature = "quinn")]
|
||||
pub fn for_quinn(self) -> Result<quinn::ServerConfig, TlsError> { ... }
|
||||
}
|
||||
```
|
||||
|
||||
```rust
|
||||
// signing.rs
|
||||
|
||||
/// Ed25519 signing key usable as both a rustls `SigningKey` and `Signer`.
|
||||
/// Consolidated — one copy used by both server (`RawKeyCertResolver`) and
|
||||
/// client (`RawKeyClientCertResolver`).
|
||||
pub struct Ed25519SigningKey { ... }
|
||||
```
|
||||
|
||||
```rust
|
||||
// pem.rs
|
||||
|
||||
/// Load a PEM-encoded certificate chain from a file path.
|
||||
pub fn load_cert_chain(path: &Path) -> Result<Vec<CertificateDer<'static>>, TlsError> { ... }
|
||||
|
||||
/// Load a PEM-encoded private key from a file path.
|
||||
pub fn load_private_key(path: &Path) -> Result<PrivateKeyDer<'static>, TlsError> { ... }
|
||||
```
|
||||
|
||||
### TlsError
|
||||
|
||||
Define a unified error type:
|
||||
|
||||
```rust
|
||||
#[derive(Debug, thiserror::Error)]
|
||||
pub enum TlsError {
|
||||
#[error("TLS config error: {0}")]
|
||||
Config(String),
|
||||
#[error("I/O error: {0}")]
|
||||
Io(#[from] std::io::Error),
|
||||
#[error("certificate error: {0}")]
|
||||
Cert(String),
|
||||
}
|
||||
```
|
||||
|
||||
### Adaptations
|
||||
|
||||
1. **Error types**: Replace `EndpointError::TlsConfig(...)` with `TlsError::Config(...)` or `TlsError::Io(...)`. The `EndpointError` type stays in core — the extracted code uses `TlsError` instead.
|
||||
2. **Imports**: Update all `crate::config::*` imports to `alknet_core::config::*`. Update `crate::fingerprint::*` to `alknet_core::fingerprint::*`.
|
||||
3. **`Ed25519SigningKey`**: Move to `signing.rs` as a shared type. Both `server.rs` and (later) `client.rs` will use it from there.
|
||||
4. **`load_cert_chain` / `load_private_key`**: Move to `pem.rs` as shared functions. Both `server.rs` and (later) `client.rs` will use them from there.
|
||||
5. **`build_iroh_endpoint`**: This is an iroh-specific builder, not pure TLS. Gate on `#[cfg(feature = "iroh")]` and depend on `alknet-core/iroh`. If the iroh dep is too heavy for `alknet-tls`, leave it in core for now and note as a TODO.
|
||||
6. **Feature gates**: `AcceptAnyCertVerifier`, `RawKeyCertResolver`, `SelfSignedCert`, `generate_self_signed_cert`, `build_rustls_server_config`, `build_quinn_server_config_from_rustls` are gated on `#[cfg(feature = "quinn")]`. `build_iroh_endpoint` is gated on `#[cfg(feature = "iroh")]`. `TlsSetup::new_acme` is gated on `#[cfg(feature = "acme")]`.
|
||||
|
||||
### What stays in core
|
||||
|
||||
The old code in `endpoint.rs` lines 493-934 is **not deleted** — it stays as a duplicate.
|
||||
The prune happens in Phase 4. This task only adds code to `alknet-tls`.
|
||||
|
||||
## Acceptance Criteria
|
||||
|
||||
- [ ] `crates/alknet-tls/src/server.rs` contains `TlsServerConfig`, `TlsSetup`, `build_rustls_server_config`, `build_quinn_server_config_from_rustls`, `RawKeyCertResolver`, `AcceptAnyCertVerifier`, `SelfSignedCert`, `generate_self_signed_cert`
|
||||
- [ ] `crates/alknet-tls/src/signing.rs` contains `Ed25519SigningKey` with `SigningKey` + `Signer` impls
|
||||
- [ ] `crates/alknet-tls/src/pem.rs` contains `load_cert_chain` + `load_private_key`
|
||||
- [ ] `TlsServerConfig::new()` accepts `&TlsIdentity` + `&[Vec<u8>]` and returns `Result<Self, TlsError>`
|
||||
- [ ] `TlsServerConfig::for_quinn()` converts to `quinn::ServerConfig` (feature-gated)
|
||||
- [ ] `TlsError` enum has `Config`, `Io`, `Cert` variants
|
||||
- [ ] All extracted code uses `TlsError` (not `EndpointError`)
|
||||
- [ ] All extracted code imports from `alknet_core` (not `crate::`)
|
||||
- [ ] Feature gates correct: `quinn` for TLS types, `acme` for ACME, `iroh` for iroh builder
|
||||
- [ ] `cargo check -p alknet-tls` succeeds (all feature combos)
|
||||
- [ ] `cargo clippy -p alknet-tls` succeeds with no warnings
|
||||
- [ ] `cargo test -p alknet-core` still passes (old code untouched)
|
||||
- [ ] `cargo test -p alknet-call` still passes (old code untouched)
|
||||
|
||||
## References
|
||||
|
||||
- docs/research/alknet-crate-extraction/findings.md — Phase 1, server-side extraction
|
||||
- crates/alknet-core/src/endpoint.rs — lines 493-934 (source code to extract)
|
||||
- crates/alknet-core/src/config.rs — `TlsIdentity`, `Ed25519SecretKey`, `AcmeDirectory`
|
||||
- crates/alknet-core/src/fingerprint.rs — `extract_ed25519_raw_key_from_spki`
|
||||
|
||||
## Notes
|
||||
|
||||
> This is the largest single extraction in Phase 1 (~440 lines). The code is
|
||||
> well-understood and tested — the main work is adapting error types and imports.
|
||||
> `Ed25519SigningKey` and `load_cert_chain`/`load_private_key` are extracted to
|
||||
> shared modules because the client-side extraction (next task) also needs them.
|
||||
> The `build_iroh_endpoint` function may be deferred if the iroh dep is too heavy
|
||||
> for `alknet-tls` — note as TODO if so. The old code in `endpoint.rs` is NOT
|
||||
> deleted — that's Phase 4.
|
||||
|
||||
## Summary
|
||||
|
||||
> To be filled on completion
|
||||
@@ -0,0 +1,126 @@
|
||||
---
|
||||
id: tls/tests
|
||||
name: Move and adapt TLS tests from endpoint.rs and call_client.rs into alknet-tls
|
||||
status: pending
|
||||
depends_on: [tls/client-extract]
|
||||
scope: moderate
|
||||
risk: low
|
||||
impact: component
|
||||
level: implementation
|
||||
---
|
||||
|
||||
## Description
|
||||
|
||||
Phase 1, Task 4 of the crate extraction. Move the TLS-related tests from
|
||||
`crates/alknet-core/src/endpoint.rs` and `crates/alknet-call/src/client/call_client.rs`
|
||||
into `crates/alknet-tls/`. Adapt them to test the new public API types
|
||||
(`TlsServerConfig`, `TlsClientConfig`) instead of the old free functions.
|
||||
|
||||
The old tests **stay** in their original files (duplicated) — no breakage. The new
|
||||
crate's tests are self-contained and pass standalone.
|
||||
|
||||
### Server-side tests to move (from `endpoint.rs`)
|
||||
|
||||
22 tests total. Move to `crates/alknet-tls/src/server.rs` `#[cfg(test)] mod tests`:
|
||||
|
||||
| Test | Line | What it tests |
|
||||
|------|------|---------------|
|
||||
| `raw_key_cert_resolver_only_raw_public_keys` | 1099 | `RawKeyCertResolver` trait impl |
|
||||
| `self_signed_cert_generation_produces_cert_and_key` | 1204 | `generate_self_signed_cert` |
|
||||
| `acme_directory_production_url` | 1255 | `AcmeDirectory::Production` URL |
|
||||
| `acme_directory_staging_url` | 1262 | `AcmeDirectory::Staging` URL |
|
||||
| `acme_directory_custom_url` | 1272 | `AcmeDirectory::Custom` URL |
|
||||
| `tls_setup_x509_returns_no_acme_state` | 1280 | `TlsSetup::new` with X509 |
|
||||
| `build_rustls_server_config_raw_key_succeeds` | 1368 | `build_rustls_server_config` RawKey |
|
||||
| `build_rustls_server_config_self_signed_succeeds` | 1379 | `build_rustls_server_config` SelfSigned |
|
||||
| `build_rustls_server_config_acme_is_unreachable` | 1391 | ACME guard in `build_rustls_server_config` |
|
||||
| `build_quinn_server_config_from_rustls_succeeds` | 1403 | `build_quinn_server_config_from_rustls` |
|
||||
| `load_private_key_returns_error_when_no_key_present` | 1415 | `load_private_key` error path |
|
||||
| `load_private_key_returns_error_when_file_missing` | 1428 | `load_private_key` missing file |
|
||||
| `load_cert_chain_returns_error_when_file_missing` | 1440 | `load_cert_chain` missing file |
|
||||
| `accept_any_cert_verifier_offers_and_does_not_require_client_auth` | 1454 | `AcceptAnyCertVerifier` trait |
|
||||
| `accept_any_cert_verifier_verifies_any_client_cert` | 1464 | `AcceptAnyCertVerifier` verify |
|
||||
| `accept_any_cert_verifier_supported_schemes_are_non_empty` | 1478 | `AcceptAnyCertVerifier` schemes |
|
||||
| `accept_any_cert_verifier_debug_is_implemented` | 1489 | `AcceptAnyCertVerifier` Debug |
|
||||
| `ed25519_signing_key_choose_scheme_returns_some_for_ed25519` | 1499 | `Ed25519SigningKey` choose_scheme |
|
||||
| `ed25519_signing_key_choose_scheme_returns_none_without_ed25519` | 1512 | `Ed25519SigningKey` no ED25519 |
|
||||
| `ed25519_signing_key_algorithm_is_ed25519` | 1525 | `Ed25519SigningKey` algorithm |
|
||||
| `ed25519_signing_key_public_key_returns_spki` | 1534 | `Ed25519SigningKey` public_key |
|
||||
| `ed25519_signing_key_signer_signs_message` | 1545 | `Ed25519SigningKey` sign |
|
||||
| `ed25519_signing_key_debug_does_not_leak_material` | 1560 | `Ed25519SigningKey` Debug |
|
||||
| `raw_key_cert_resolver_debug_is_implemented` | 1569 | `RawKeyCertResolver` Debug |
|
||||
|
||||
### Client-side tests to move (from `call_client.rs`)
|
||||
|
||||
10 tests total. Move to `crates/alknet-tls/src/client.rs` `#[cfg(test)] mod tests`:
|
||||
|
||||
| Test | Line | What it tests | Adaptation |
|
||||
|------|------|---------------|------------|
|
||||
| `fingerprint_pin_verifier_matches_correct_ed25519_fingerprint` | 750 | verifier accept | Test via `FingerprintPinVerifier` directly (no change needed) |
|
||||
| `fingerprint_pin_verifier_rejects_wrong_ed25519_fingerprint` | 769 | verifier reject | Same |
|
||||
| `fingerprint_pin_verifier_matches_correct_sha256_fingerprint` | 789 | verifier X.509 accept | Same |
|
||||
| `fingerprint_pin_verifier_rejects_wrong_sha256_fingerprint` | 806 | verifier X.509 reject | Same |
|
||||
| `select_server_verifier_returns_ca_verifier_for_none` | 822 | CA path | Test via `TlsClientConfig::new` or keep as unit test of internal fn |
|
||||
| `select_server_verifier_returns_fingerprint_pin_for_some` | 839 | pin path | Same |
|
||||
| `build_client_auth_presents_ed25519_raw_key_without_error` | 857 | client cert resolver | Test via `TlsClientConfig::new` or keep as unit test |
|
||||
| `build_client_auth_none_resolves_to_no_client_cert` | 879 | no-cert resolver | Same |
|
||||
| `build_quinn_client_config_with_raw_key_identity_builds_without_error` | 893 | full config build | Adapt to test `TlsClientConfig::new` + `for_quinn()` |
|
||||
| `build_quinn_client_config_with_no_remote_identity_builds_without_error` | 909 | CA-verify config | Adapt to test `TlsClientConfig::new` + `for_quinn()` |
|
||||
|
||||
### Test adaptations
|
||||
|
||||
1. **Imports**: Update to use `alknet_tls::*` types, `alknet_core::config::*`, etc.
|
||||
2. **Server tests**: Most server-side tests test free functions directly — they can stay
|
||||
as unit tests of the internal functions, or be adapted to test through `TlsServerConfig::new()`.
|
||||
The `tls_setup_x509_returns_no_acme_state` test should go through `TlsServerConfig::new()`.
|
||||
3. **Client tests**: The `build_quinn_client_config_*` tests should be adapted to test
|
||||
`TlsClientConfig::new(credentials, alpn)?.for_quinn()` instead of the free function.
|
||||
The verifier and client-auth tests can stay as unit tests of the internal functions.
|
||||
4. **`Ed25519SigningKey` tests**: Move to `crates/alknet-tls/src/signing.rs` `#[cfg(test)] mod tests`.
|
||||
5. **`load_cert_chain` / `load_private_key` tests**: Move to `crates/alknet-tls/src/pem.rs` `#[cfg(test)] mod tests`.
|
||||
6. **Test helpers**: The `build_ed25519_spki_der`, `build_x509_cert_der`, `aws_lc_rs_provider`,
|
||||
`verify_pin` helpers from `call_client.rs` tests should move with the tests that use them.
|
||||
7. **Feature gates**: All quinn-dependent tests need `#[cfg(feature = "quinn")]`. The
|
||||
`acme_directory_*` tests don't need quinn. The `ed25519_signing_key_*` tests need quinn
|
||||
(they use `rustls::sign::SigningKey`).
|
||||
|
||||
### What stays in the original files
|
||||
|
||||
The old tests in `endpoint.rs` and `call_client.rs` are **not deleted** — they stay as
|
||||
duplicates. The prune happens in Phase 4 (core) and Phase 5 (call). This task only adds
|
||||
tests to `alknet-tls`.
|
||||
|
||||
## Acceptance Criteria
|
||||
|
||||
- [ ] All 22 server-side TLS tests moved to `alknet-tls/src/server.rs` and pass
|
||||
- [ ] All 10 client-side TLS tests moved to `alknet-tls/src/client.rs` and pass
|
||||
- [ ] `Ed25519SigningKey` tests (6) moved to `alknet-tls/src/signing.rs` and pass
|
||||
- [ ] `load_cert_chain` / `load_private_key` tests (3) moved to `alknet-tls/src/pem.rs` and pass
|
||||
- [ ] `build_quinn_client_config_*` tests adapted to use `TlsClientConfig::new().for_quinn()`
|
||||
- [ ] `tls_setup_x509_returns_no_acme_state` adapted to use `TlsServerConfig::new()`
|
||||
- [ ] All test helpers (`build_ed25519_spki_der`, `build_x509_cert_der`, `aws_lc_rs_provider`, `verify_pin`) moved with their tests
|
||||
- [ ] Feature gates correct on all moved tests
|
||||
- [ ] `cargo test -p alknet-tls` passes (all feature combos)
|
||||
- [ ] `cargo test -p alknet-core` still passes (old tests untouched)
|
||||
- [ ] `cargo test -p alknet-call` still passes (old tests untouched)
|
||||
- [ ] `cargo clippy -p alknet-tls --all-targets` succeeds with no warnings
|
||||
|
||||
## References
|
||||
|
||||
- docs/research/alknet-crate-extraction/findings.md — Phase 1, test lists
|
||||
- crates/alknet-core/src/endpoint.rs — lines 935-1606 (server-side tests)
|
||||
- crates/alknet-call/src/client/call_client.rs — lines 569-930 (client-side tests)
|
||||
|
||||
## Notes
|
||||
|
||||
> This is the test migration task — 32 tests total (22 server + 10 client).
|
||||
> The tests are well-understood and mostly need import updates. The
|
||||
> `build_quinn_client_config_*` tests need the most adaptation (testing through
|
||||
> `TlsClientConfig` instead of the free function). The old tests stay in their
|
||||
> original files — the prune happens in Phases 4-5. Test helpers that are shared
|
||||
> between multiple test functions should move to a `#[cfg(test)]` module in the
|
||||
> same file.
|
||||
|
||||
## Summary
|
||||
|
||||
> To be filled on completion
|
||||
Reference in new issue
Block a user