Add CERT_DAYS setting and resolve_cert_days()

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

tests/test_config_file.py

@@ -60,3 +60,10 @@ def test_comments_and_non_string_types_supported(tmp_path):
     )
     overrides = load_settings_overrides(None, "", _script_path(tmp_path))
     assert overrides == {"SMTP_PORT": 2525, "CA_PASSPHRASE": ""}
+
+
+def test_cert_days_is_overridable(tmp_path):
+    conf = tmp_path / "app.conf"
+    conf.write_text('CERT_DAYS = 90\n')
+    out = load_settings_overrides(str(conf), "", str(tmp_path / "app.py"))
+    assert out["CERT_DAYS"] == 90

tests/test_easyrsa.py

@@ -4,7 +4,7 @@ import pytest
 from unittest.mock import patch, MagicMock
 from openvpncertupdate import (
     revoke_issued, build_client_full, gen_crl, copy_crl, EasyRSAError,
-    is_ca_key_encrypted, resolve_ca_passphrase,
+    is_ca_key_encrypted, resolve_ca_passphrase, resolve_cert_days, ConfigError,
     has_issued_cert, issued_cert_path,
 )
 
@@ -244,3 +244,45 @@ def test_resolve_literal_passphrase_passed_through_unchanged(tmp_path):
     result = resolve_ca_passphrase("mysecret", str(tmp_path), prompt=prompt)
     assert result == "mysecret"
     prompt.assert_not_called()
+
+
+# ---------------------------------------------------------------------------
+# resolve_cert_days
+# ---------------------------------------------------------------------------
+
+@pytest.mark.parametrize("configured", ["default", "", "  ", "  default  "])
+def test_resolve_cert_days_sentinels_mean_inherit(configured):
+    # "" and "default" leave the lifetime to EasyRSA's own EASYRSA_CERT_EXPIRE,
+    # so deploying this cannot silently shorten certs on an existing PKI.
+    assert resolve_cert_days(configured) == ""
+
+
+@pytest.mark.parametrize("configured,expected", [
+    (90, "90"), ("90", "90"), ("  90  ", "90"), (1, "1"), (3650, "3650"),
+])
+def test_resolve_cert_days_accepts_positive_numbers(configured, expected):
+    assert resolve_cert_days(configured) == expected
+
+
+def test_resolve_cert_days_normalises_leading_zeros():
+    # EasyRSA's own pattern rejects "090" with "Number expected", which reads
+    # as nonsense to someone who typed only digits.
+    assert resolve_cert_days("090") == "90"
+
+
+def test_resolve_cert_days_rejects_zero():
+    with pytest.raises(ConfigError, match="positive"):
+        resolve_cert_days("0")
+
+
+@pytest.mark.parametrize("configured", ["-5", -5, "abc", "9 0", "90.5", 90.5, None])
+def test_resolve_cert_days_rejects_junk(configured):
+    with pytest.raises(ConfigError):
+        resolve_cert_days(configured)
+
+
+def test_resolve_cert_days_error_names_the_source():
+    # The same resolver serves CERT_DAYS, --days and the TUI field; the message
+    # must say which one the user actually touched.
+    with pytest.raises(ConfigError, match="--days"):
+        resolve_cert_days("0", "--days")