tasks: decompose phases 0-1 of crate extraction into implementation tasks
Phase 0 (core/connection-credentials): purely additive — add ConnectionCredentials + RemoteIdentity to alknet-core. No call crate changes. ~40 lines, zero breakage. Phase 1 (tls/*): greenfield alknet-tls crate in 5 tasks: - tls/crate-init: Cargo.toml, deps, module skeleton - tls/server-extract: TlsServerConfig + server TLS code from endpoint.rs - tls/client-extract: TlsClientConfig + client TLS code from call_client.rs - tls/tests: 32 TLS tests moved and adapted - tls/review-tls: phase gate review checkpoint All old code stays duplicated — purely additive phases. Prunes in 4-5.
This commit is contained in:
deepseek-v4-pro committed
1 parent
e91d943857
commit
4ced71f44a
6 files changed
+815
No files matched your search
@@ -0,0 +1,126 @@
|
||||
---
|
||||
id: tls/tests
|
||||
name: Move and adapt TLS tests from endpoint.rs and call_client.rs into alknet-tls
|
||||
status: pending
|
||||
depends_on: [tls/client-extract]
|
||||
scope: moderate
|
||||
risk: low
|
||||
impact: component
|
||||
level: implementation
|
||||
---
|
||||
|
||||
## Description
|
||||
|
||||
Phase 1, Task 4 of the crate extraction. Move the TLS-related tests from
|
||||
`crates/alknet-core/src/endpoint.rs` and `crates/alknet-call/src/client/call_client.rs`
|
||||
into `crates/alknet-tls/`. Adapt them to test the new public API types
|
||||
(`TlsServerConfig`, `TlsClientConfig`) instead of the old free functions.
|
||||
|
||||
The old tests **stay** in their original files (duplicated) — no breakage. The new
|
||||
crate's tests are self-contained and pass standalone.
|
||||
|
||||
### Server-side tests to move (from `endpoint.rs`)
|
||||
|
||||
22 tests total. Move to `crates/alknet-tls/src/server.rs` `#[cfg(test)] mod tests`:
|
||||
|
||||
| Test | Line | What it tests |
|
||||
|------|------|---------------|
|
||||
| `raw_key_cert_resolver_only_raw_public_keys` | 1099 | `RawKeyCertResolver` trait impl |
|
||||
| `self_signed_cert_generation_produces_cert_and_key` | 1204 | `generate_self_signed_cert` |
|
||||
| `acme_directory_production_url` | 1255 | `AcmeDirectory::Production` URL |
|
||||
| `acme_directory_staging_url` | 1262 | `AcmeDirectory::Staging` URL |
|
||||
| `acme_directory_custom_url` | 1272 | `AcmeDirectory::Custom` URL |
|
||||
| `tls_setup_x509_returns_no_acme_state` | 1280 | `TlsSetup::new` with X509 |
|
||||
| `build_rustls_server_config_raw_key_succeeds` | 1368 | `build_rustls_server_config` RawKey |
|
||||
| `build_rustls_server_config_self_signed_succeeds` | 1379 | `build_rustls_server_config` SelfSigned |
|
||||
| `build_rustls_server_config_acme_is_unreachable` | 1391 | ACME guard in `build_rustls_server_config` |
|
||||
| `build_quinn_server_config_from_rustls_succeeds` | 1403 | `build_quinn_server_config_from_rustls` |
|
||||
| `load_private_key_returns_error_when_no_key_present` | 1415 | `load_private_key` error path |
|
||||
| `load_private_key_returns_error_when_file_missing` | 1428 | `load_private_key` missing file |
|
||||
| `load_cert_chain_returns_error_when_file_missing` | 1440 | `load_cert_chain` missing file |
|
||||
| `accept_any_cert_verifier_offers_and_does_not_require_client_auth` | 1454 | `AcceptAnyCertVerifier` trait |
|
||||
| `accept_any_cert_verifier_verifies_any_client_cert` | 1464 | `AcceptAnyCertVerifier` verify |
|
||||
| `accept_any_cert_verifier_supported_schemes_are_non_empty` | 1478 | `AcceptAnyCertVerifier` schemes |
|
||||
| `accept_any_cert_verifier_debug_is_implemented` | 1489 | `AcceptAnyCertVerifier` Debug |
|
||||
| `ed25519_signing_key_choose_scheme_returns_some_for_ed25519` | 1499 | `Ed25519SigningKey` choose_scheme |
|
||||
| `ed25519_signing_key_choose_scheme_returns_none_without_ed25519` | 1512 | `Ed25519SigningKey` no ED25519 |
|
||||
| `ed25519_signing_key_algorithm_is_ed25519` | 1525 | `Ed25519SigningKey` algorithm |
|
||||
| `ed25519_signing_key_public_key_returns_spki` | 1534 | `Ed25519SigningKey` public_key |
|
||||
| `ed25519_signing_key_signer_signs_message` | 1545 | `Ed25519SigningKey` sign |
|
||||
| `ed25519_signing_key_debug_does_not_leak_material` | 1560 | `Ed25519SigningKey` Debug |
|
||||
| `raw_key_cert_resolver_debug_is_implemented` | 1569 | `RawKeyCertResolver` Debug |
|
||||
|
||||
### Client-side tests to move (from `call_client.rs`)
|
||||
|
||||
10 tests total. Move to `crates/alknet-tls/src/client.rs` `#[cfg(test)] mod tests`:
|
||||
|
||||
| Test | Line | What it tests | Adaptation |
|
||||
|------|------|---------------|------------|
|
||||
| `fingerprint_pin_verifier_matches_correct_ed25519_fingerprint` | 750 | verifier accept | Test via `FingerprintPinVerifier` directly (no change needed) |
|
||||
| `fingerprint_pin_verifier_rejects_wrong_ed25519_fingerprint` | 769 | verifier reject | Same |
|
||||
| `fingerprint_pin_verifier_matches_correct_sha256_fingerprint` | 789 | verifier X.509 accept | Same |
|
||||
| `fingerprint_pin_verifier_rejects_wrong_sha256_fingerprint` | 806 | verifier X.509 reject | Same |
|
||||
| `select_server_verifier_returns_ca_verifier_for_none` | 822 | CA path | Test via `TlsClientConfig::new` or keep as unit test of internal fn |
|
||||
| `select_server_verifier_returns_fingerprint_pin_for_some` | 839 | pin path | Same |
|
||||
| `build_client_auth_presents_ed25519_raw_key_without_error` | 857 | client cert resolver | Test via `TlsClientConfig::new` or keep as unit test |
|
||||
| `build_client_auth_none_resolves_to_no_client_cert` | 879 | no-cert resolver | Same |
|
||||
| `build_quinn_client_config_with_raw_key_identity_builds_without_error` | 893 | full config build | Adapt to test `TlsClientConfig::new` + `for_quinn()` |
|
||||
| `build_quinn_client_config_with_no_remote_identity_builds_without_error` | 909 | CA-verify config | Adapt to test `TlsClientConfig::new` + `for_quinn()` |
|
||||
|
||||
### Test adaptations
|
||||
|
||||
1. **Imports**: Update to use `alknet_tls::*` types, `alknet_core::config::*`, etc.
|
||||
2. **Server tests**: Most server-side tests test free functions directly — they can stay
|
||||
as unit tests of the internal functions, or be adapted to test through `TlsServerConfig::new()`.
|
||||
The `tls_setup_x509_returns_no_acme_state` test should go through `TlsServerConfig::new()`.
|
||||
3. **Client tests**: The `build_quinn_client_config_*` tests should be adapted to test
|
||||
`TlsClientConfig::new(credentials, alpn)?.for_quinn()` instead of the free function.
|
||||
The verifier and client-auth tests can stay as unit tests of the internal functions.
|
||||
4. **`Ed25519SigningKey` tests**: Move to `crates/alknet-tls/src/signing.rs` `#[cfg(test)] mod tests`.
|
||||
5. **`load_cert_chain` / `load_private_key` tests**: Move to `crates/alknet-tls/src/pem.rs` `#[cfg(test)] mod tests`.
|
||||
6. **Test helpers**: The `build_ed25519_spki_der`, `build_x509_cert_der`, `aws_lc_rs_provider`,
|
||||
`verify_pin` helpers from `call_client.rs` tests should move with the tests that use them.
|
||||
7. **Feature gates**: All quinn-dependent tests need `#[cfg(feature = "quinn")]`. The
|
||||
`acme_directory_*` tests don't need quinn. The `ed25519_signing_key_*` tests need quinn
|
||||
(they use `rustls::sign::SigningKey`).
|
||||
|
||||
### What stays in the original files
|
||||
|
||||
The old tests in `endpoint.rs` and `call_client.rs` are **not deleted** — they stay as
|
||||
duplicates. The prune happens in Phase 4 (core) and Phase 5 (call). This task only adds
|
||||
tests to `alknet-tls`.
|
||||
|
||||
## Acceptance Criteria
|
||||
|
||||
- [ ] All 22 server-side TLS tests moved to `alknet-tls/src/server.rs` and pass
|
||||
- [ ] All 10 client-side TLS tests moved to `alknet-tls/src/client.rs` and pass
|
||||
- [ ] `Ed25519SigningKey` tests (6) moved to `alknet-tls/src/signing.rs` and pass
|
||||
- [ ] `load_cert_chain` / `load_private_key` tests (3) moved to `alknet-tls/src/pem.rs` and pass
|
||||
- [ ] `build_quinn_client_config_*` tests adapted to use `TlsClientConfig::new().for_quinn()`
|
||||
- [ ] `tls_setup_x509_returns_no_acme_state` adapted to use `TlsServerConfig::new()`
|
||||
- [ ] All test helpers (`build_ed25519_spki_der`, `build_x509_cert_der`, `aws_lc_rs_provider`, `verify_pin`) moved with their tests
|
||||
- [ ] Feature gates correct on all moved tests
|
||||
- [ ] `cargo test -p alknet-tls` passes (all feature combos)
|
||||
- [ ] `cargo test -p alknet-core` still passes (old tests untouched)
|
||||
- [ ] `cargo test -p alknet-call` still passes (old tests untouched)
|
||||
- [ ] `cargo clippy -p alknet-tls --all-targets` succeeds with no warnings
|
||||
|
||||
## References
|
||||
|
||||
- docs/research/alknet-crate-extraction/findings.md — Phase 1, test lists
|
||||
- crates/alknet-core/src/endpoint.rs — lines 935-1606 (server-side tests)
|
||||
- crates/alknet-call/src/client/call_client.rs — lines 569-930 (client-side tests)
|
||||
|
||||
## Notes
|
||||
|
||||
> This is the test migration task — 32 tests total (22 server + 10 client).
|
||||
> The tests are well-understood and mostly need import updates. The
|
||||
> `build_quinn_client_config_*` tests need the most adaptation (testing through
|
||||
> `TlsClientConfig` instead of the free function). The old tests stay in their
|
||||
> original files — the prune happens in Phases 4-5. Test helpers that are shared
|
||||
> between multiple test functions should move to a `#[cfg(test)]` module in the
|
||||
> same file.
|
||||
|
||||
## Summary
|
||||
|
||||
> To be filled on completion
|
||||
Reference in new issue
Block a user