VaKU/openvpncertupdate
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
9e5df8d9bb51c0540358573cd7397a994c86a4f1
openvpncertupdate/tests/test_cli.py
Vlad Doloman 9e5df8d9bb Fix re-issue for CNs whose issued cert file is missing 
Renewal failed with an empty error box for any CN listed in index.txt
without a corresponding pki/issued/<CN>.crt — the state you get when an
index.txt is carried over from an older EasyRSA install but the issued/
files are not.

Two defects:

1. EasyRSA writes its diagnostics to stdout, not stderr: print() is
   `printf '%s\n'`, and both die() and user_error() route through it.
   stderr only carries output from the tools EasyRSA shells out to, and
   even that is silenced under -S/--silent-ssl. _run_easyrsa built its
   message from stderr alone, so every EasyRSA failure reported blank.
   _easyrsa_diagnostics() now merges both streams (stderr first, so the
   specific openssl message is not what the dialog clips) and drops the
   version banner and blank padding.

2. EasyRSA reads the serial out of the .crt itself, so revoke-issued
   cannot revoke a CN whose cert file is gone — and there is nothing to
   add to the CRL either. has_issued_cert() now gates the revoke and CRL
   steps in both CliRunner._issue() and CursesApp._process_cert(); the
   workflow warns and goes straight to build-client-full. An explicit
   --revoke / TUI `r` still fails loudly rather than silently no-op.

The post-build failure message now keys off whether a revoke actually
happened, not off is_renewal, so it no longer claims "has been revoked"
when nothing was.

Adds tests/test_app_reissue.py: the TUI re-issue path had no coverage at
all, and it is the path this bug was reported from.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-15 04:08:25 +03:00

595 lines
25 KiB
Python
Raw Blame History

"""Tests for CLI mode (CliRunner + main() argument dispatch)."""
import sys
from unittest.mock import MagicMock, patch, call
import pytest
from openvpncertupdate import CliRunner, _build_parser, main
# Bound before _patch_issue() rebinds the module attribute, so tests can put
# the real filesystem check back and exercise the wiring end to end.
from openvpncertupdate import has_issued_cert as real_has_issued_cert
# ---------------------------------------------------------------------------
# Helpers
# ---------------------------------------------------------------------------
def _patch_issue(monkeypatch, ovpn_path="/out/cn_2026-01-01/client.ovpn",
one_time_url="https://cg.example.com/#/note/abc/xyz"):
"""Patch all side-effectful callables used by CliRunner._issue."""
# Default to "the issued .crt is there", the normal case; the tests that
# care about a missing cert file override this.
monkeypatch.setattr("openvpncertupdate.has_issued_cert", MagicMock(return_value=True))
monkeypatch.setattr("openvpncertupdate.revoke_issued", MagicMock())
monkeypatch.setattr("openvpncertupdate.gen_crl", MagicMock())
monkeypatch.setattr("openvpncertupdate.copy_crl", MagicMock())
monkeypatch.setattr("openvpncertupdate.build_client_full", MagicMock())
monkeypatch.setattr("openvpncertupdate.build_ovpn", MagicMock(return_value=ovpn_path))
monkeypatch.setattr("openvpncertupdate.create_note", MagicMock(return_value=one_time_url))
monkeypatch.setattr("openvpncertupdate.send_email", MagicMock())
monkeypatch.setattr("openvpncertupdate.generate_password", MagicMock(return_value="Testpass1234567890abcdefgh"))
return {
"revoke_issued": sys.modules["openvpncertupdate"].revoke_issued,
"gen_crl": sys.modules["openvpncertupdate"].gen_crl,
"copy_crl": sys.modules["openvpncertupdate"].copy_crl,
"build_client_full": sys.modules["openvpncertupdate"].build_client_full,
"build_ovpn": sys.modules["openvpncertupdate"].build_ovpn,
"create_note": sys.modules["openvpncertupdate"].create_note,
"send_email": sys.modules["openvpncertupdate"].send_email,
}
# ---------------------------------------------------------------------------
# CliRunner.create
# ---------------------------------------------------------------------------
def test_create_calls_build_not_revoke(monkeypatch, capsys):
mocks = _patch_issue(monkeypatch)
CliRunner().create("alice", "alice@example.com")
mocks["revoke_issued"].assert_not_called()
mocks["build_client_full"].assert_called_once()
_, kwargs = mocks["build_client_full"].call_args
# cn is the third positional arg
assert mocks["build_client_full"].call_args.args[2] == "alice"
def test_create_passes_email_to_build_client_full(monkeypatch, capsys):
# build-client-full embeds email into the cert subject (EASYRSA_REQ_EMAIL),
# which is what index.txt / get_email() reads back later — there's no
# separate email store to save to.
mocks = _patch_issue(monkeypatch)
CliRunner().create("alice", "alice@example.com")
assert mocks["build_client_full"].call_args.kwargs["email"] == "alice@example.com"
def test_create_sends_email_and_prints_url(monkeypatch, capsys):
url = "https://cg.example.com/#/note/abc/xyz"
mocks = _patch_issue(monkeypatch, one_time_url=url)
CliRunner().create("alice", "alice@example.com")
mocks["send_email"].assert_called_once()
out = capsys.readouterr().out
assert "password-url:" in out
assert url in out
assert "password:" not in out
def test_create_prints_password_when_cryptgeon_fails(monkeypatch, capsys):
_patch_issue(monkeypatch)
import openvpncertupdate
monkeypatch.setattr("openvpncertupdate.create_note",
MagicMock(side_effect=openvpncertupdate.CryptgeonError("down")))
CliRunner().create("alice", "alice@example.com")
out = capsys.readouterr().out
assert "password:" in out
assert "password-url:" not in out
# ---------------------------------------------------------------------------
# CliRunner.reissue
# ---------------------------------------------------------------------------
def test_reissue_calls_revoke_then_build(monkeypatch, capsys):
mocks = _patch_issue(monkeypatch)
CliRunner().reissue("bob", "bob@example.com")
mocks["revoke_issued"].assert_called_once()
mocks["build_client_full"].assert_called_once()
# revoke must happen before build
assert mocks["revoke_issued"].call_args.args[2] == "bob"
assert mocks["build_client_full"].call_args.args[2] == "bob"
def test_reissue_regenerates_and_copies_crl(monkeypatch, capsys):
# The old cert is revoked as part of reissue, so the published CRL is
# stale until regenerated — reissue must do that itself now.
mocks = _patch_issue(monkeypatch)
CliRunner().reissue("bob", "bob@example.com")
mocks["gen_crl"].assert_called_once()
mocks["copy_crl"].assert_called_once()
def test_create_does_not_touch_crl(monkeypatch, capsys):
# --create never revokes anything, so there's nothing stale to fix.
mocks = _patch_issue(monkeypatch)
CliRunner().create("alice", "alice@example.com")
mocks["gen_crl"].assert_not_called()
mocks["copy_crl"].assert_not_called()
def test_reissue_skips_revoke_when_cert_file_missing(monkeypatch, capsys):
# An index.txt copied from an older EasyRSA install lists V-status certs
# whose .crt was never carried over. EasyRSA reads the serial out of the
# .crt, so revoke-issued can only fail — issue the replacement instead.
mocks = _patch_issue(monkeypatch)
monkeypatch.setattr("openvpncertupdate.has_issued_cert", MagicMock(return_value=False))
CliRunner().reissue("y.kuts", "y.kuts@example.com")
mocks["revoke_issued"].assert_not_called()
mocks["gen_crl"].assert_not_called()
mocks["copy_crl"].assert_not_called()
mocks["build_client_full"].assert_called_once()
assert mocks["build_client_full"].call_args.args[2] == "y.kuts"
def test_reissue_warns_when_revoke_skipped(monkeypatch, capsys):
mocks = _patch_issue(monkeypatch)
monkeypatch.setattr("openvpncertupdate.has_issued_cert", MagicMock(return_value=False))
CliRunner().reissue("y.kuts", "y.kuts@example.com")
err = capsys.readouterr().err
assert "nothing to revoke for y.kuts" in err
assert "issued/y.kuts.crt" in err
def test_reissue_skipped_revoke_build_failure_does_not_claim_revocation(monkeypatch, capsys):
# Nothing was revoked, so the "has been revoked but no new cert" warning
# would be a lie here.
import openvpncertupdate
_patch_issue(monkeypatch)
monkeypatch.setattr("openvpncertupdate.has_issued_cert", MagicMock(return_value=False))
monkeypatch.setattr("openvpncertupdate.build_client_full",
MagicMock(side_effect=openvpncertupdate.EasyRSAError("boom")))
with pytest.raises(SystemExit):
CliRunner().reissue("y.kuts", "y.kuts@example.com")
assert "has been revoked" not in capsys.readouterr().err
def _reissue_against_real_pki(monkeypatch, tmp_path, cert_files):
"""Run --reissue with the real has_issued_cert against a temp PKI layout."""
issued = tmp_path / "issued"
issued.mkdir()
for name in cert_files:
(issued / name).write_text("-----BEGIN CERTIFICATE-----\n")
mocks = _patch_issue(monkeypatch)
monkeypatch.setattr("openvpncertupdate.has_issued_cert", real_has_issued_cert)
monkeypatch.setattr("openvpncertupdate.EASYRSA_PKI_DIR", str(tmp_path))
CliRunner().reissue("y.kuts", "y.kuts@example.com")
return mocks
def test_reissue_reads_pki_dir_and_skips_revoke_for_missing_crt(monkeypatch, capsys, tmp_path):
# issued/ exists but holds other people's certs — exactly the server state.
mocks = _reissue_against_real_pki(
monkeypatch, tmp_path, ["ivan.radchenko.crt", "s.krasota.crt"])
mocks["revoke_issued"].assert_not_called()
mocks["build_client_full"].assert_called_once()
def test_reissue_reads_pki_dir_and_revokes_when_crt_present(monkeypatch, capsys, tmp_path):
mocks = _reissue_against_real_pki(monkeypatch, tmp_path, ["y.kuts.crt"])
mocks["revoke_issued"].assert_called_once()
mocks["gen_crl"].assert_called_once()
mocks["build_client_full"].assert_called_once()
def test_reissue_continues_building_when_crl_regen_fails(monkeypatch, capsys):
import openvpncertupdate
mocks = _patch_issue(monkeypatch)
monkeypatch.setattr("openvpncertupdate.gen_crl",
MagicMock(side_effect=openvpncertupdate.EasyRSAError("gen-crl failed")))
CliRunner().reissue("bob", "bob@example.com")
mocks["build_client_full"].assert_called_once()
assert "CRL update failed" in capsys.readouterr().err
def test_reissue_falls_back_to_index_txt_email(monkeypatch, capsys):
# get_email() reads straight from index.txt; this stubs that lookup
# rather than the file itself (index.txt parsing is covered in test_pki.py).
mocks = _patch_issue(monkeypatch)
monkeypatch.setattr("openvpncertupdate.get_email",
MagicMock(return_value="fromindex@example.com"))
CliRunner().reissue("bob", "") # no --email supplied
mocks["send_email"].assert_called_once()
assert mocks["send_email"].call_args.args[0] == "fromindex@example.com"
def test_reissue_no_email_no_send(monkeypatch, capsys):
mocks = _patch_issue(monkeypatch)
monkeypatch.setattr("openvpncertupdate.get_email", MagicMock(return_value=""))
CliRunner().reissue("bob", "")
mocks["send_email"].assert_not_called()
out, err = capsys.readouterr()
assert "config:" in out
assert "warning: email skipped (no email address on file for bob)" in err
# ---------------------------------------------------------------------------
# CliRunner.revoke
# ---------------------------------------------------------------------------
def test_revoke_calls_revoke_gen_crl_copy_crl(monkeypatch, capsys):
rev = MagicMock()
gcrl = MagicMock()
ccrl = MagicMock()
monkeypatch.setattr("openvpncertupdate.revoke_issued", rev)
monkeypatch.setattr("openvpncertupdate.gen_crl", gcrl)
monkeypatch.setattr("openvpncertupdate.copy_crl", ccrl)
CliRunner().revoke("charlie")
rev.assert_called_once()
gcrl.assert_called_once()
ccrl.assert_called_once()
assert "charlie" in capsys.readouterr().out
def test_revoke_exits_on_error(monkeypatch):
import openvpncertupdate
monkeypatch.setattr("openvpncertupdate.revoke_issued",
MagicMock(side_effect=openvpncertupdate.EasyRSAError("fail")))
with pytest.raises(SystemExit) as exc_info:
CliRunner().revoke("charlie")
assert exc_info.value.code == 1
# ---------------------------------------------------------------------------
# CliRunner.regen_crl
# ---------------------------------------------------------------------------
def test_regen_crl_calls_gen_and_copy(monkeypatch, capsys):
gcrl = MagicMock()
ccrl = MagicMock()
monkeypatch.setattr("openvpncertupdate.gen_crl", gcrl)
monkeypatch.setattr("openvpncertupdate.copy_crl", ccrl)
CliRunner().regen_crl()
gcrl.assert_called_once()
ccrl.assert_called_once()
assert "CRL" in capsys.readouterr().out
# ---------------------------------------------------------------------------
# _format_cert_table
# ---------------------------------------------------------------------------
def test_format_cert_table_empty_list():
import openvpncertupdate
assert openvpncertupdate._format_cert_table([]) == "(no certificates)"
def test_format_cert_table_header_and_columns(monkeypatch):
import openvpncertupdate
certs = [
openvpncertupdate.CertInfo(cn="alice", expires=None, days_left=24),
openvpncertupdate.CertInfo(cn="bob", expires=None, days_left=-5),
]
monkeypatch.setattr(
"openvpncertupdate.get_email",
MagicMock(side_effect=lambda pki, cn: {"alice": "alice@example.com"}.get(cn, "")),
)
table = openvpncertupdate._format_cert_table(certs)
lines = table.splitlines()
assert lines[0].split() == ["CN", "EXPIRES", "EMAIL"]
assert len(lines) == 3
def test_format_cert_table_shows_email_and_none_placeholder(monkeypatch):
import openvpncertupdate
certs = [
openvpncertupdate.CertInfo(cn="alice", expires=None, days_left=24),
openvpncertupdate.CertInfo(cn="bob", expires=None, days_left=-5),
]
monkeypatch.setattr(
"openvpncertupdate.get_email",
MagicMock(side_effect=lambda pki, cn: {"alice": "alice@example.com"}.get(cn, "")),
)
table = openvpncertupdate._format_cert_table(certs)
lines = table.splitlines()
assert "alice@example.com" in lines[1]
assert "(none)" in lines[2]
def test_format_cert_table_columns_are_aligned(monkeypatch):
import openvpncertupdate
certs = [
openvpncertupdate.CertInfo(cn="a", expires=None, days_left=24),
openvpncertupdate.CertInfo(cn="a-much-longer", expires=None, days_left=5),
]
monkeypatch.setattr("openvpncertupdate.get_email", MagicMock(return_value=""))
table = openvpncertupdate._format_cert_table(certs)
lines = table.splitlines()
# The EMAIL column must start at the same character offset on every row.
email_col = len(lines[0]) - len("EMAIL")
for line in lines[1:]:
assert line.rstrip().endswith("(none)")
assert line.index("(none)") == email_col
# ---------------------------------------------------------------------------
# CliRunner.list_certs
# ---------------------------------------------------------------------------
def test_list_certs_expiring_uses_days_settings(monkeypatch, capsys):
mock_load = MagicMock(return_value=[])
monkeypatch.setattr("openvpncertupdate.load_expiring_certs", mock_load)
monkeypatch.setattr("openvpncertupdate.DAYS_PAST", 30)
monkeypatch.setattr("openvpncertupdate.DAYS_AHEAD", 14)
monkeypatch.setattr("openvpncertupdate.EASYRSA_PKI_DIR", "/pki")
CliRunner().list_certs(show_all=False)
mock_load.assert_called_once_with("/pki", 30, 14)
assert "(no certificates)" in capsys.readouterr().out
def test_list_certs_all_uses_load_all_certs(monkeypatch, capsys):
mock_load = MagicMock(return_value=[])
monkeypatch.setattr("openvpncertupdate.load_all_certs", mock_load)
monkeypatch.setattr("openvpncertupdate.EASYRSA_PKI_DIR", "/pki")
CliRunner().list_certs(show_all=True)
mock_load.assert_called_once_with("/pki")
assert "(no certificates)" in capsys.readouterr().out
def test_list_certs_prints_formatted_table(monkeypatch, capsys):
import openvpncertupdate
certs = [openvpncertupdate.CertInfo(cn="alice", expires=None, days_left=10)]
monkeypatch.setattr("openvpncertupdate.load_expiring_certs", MagicMock(return_value=certs))
monkeypatch.setattr("openvpncertupdate.get_email", MagicMock(return_value="alice@example.com"))
CliRunner().list_certs(show_all=False)
out = capsys.readouterr().out
assert "alice" in out
assert "alice@example.com" in out
# ---------------------------------------------------------------------------
# main() argument dispatch
# ---------------------------------------------------------------------------
def test_main_create_requires_email(monkeypatch):
monkeypatch.setattr(sys, "argv", ["prog", "--create", "alice"])
with pytest.raises(SystemExit) as exc_info:
main()
assert exc_info.value.code != 0
def test_main_dispatches_create(monkeypatch):
monkeypatch.setattr(sys, "argv",
["prog", "--create", "alice", "--email", "a@b.com"])
runner = MagicMock()
monkeypatch.setattr("openvpncertupdate.CliRunner", lambda: runner)
main()
runner.create.assert_called_once_with("alice", "a@b.com", send_email_flag=True, show_eml=False)
def test_main_dispatches_reissue(monkeypatch):
monkeypatch.setattr(sys, "argv", ["prog", "--reissue", "bob"])
runner = MagicMock()
monkeypatch.setattr("openvpncertupdate.CliRunner", lambda: runner)
main()
runner.reissue.assert_called_once_with("bob", "", send_email_flag=True, show_eml=False)
def test_main_dispatches_revoke(monkeypatch):
monkeypatch.setattr(sys, "argv", ["prog", "--revoke", "charlie"])
runner = MagicMock()
monkeypatch.setattr("openvpncertupdate.CliRunner", lambda: runner)
main()
runner.revoke.assert_called_once_with("charlie")
def test_main_dispatches_gen_crl(monkeypatch):
monkeypatch.setattr(sys, "argv", ["prog", "--gen-crl"])
runner = MagicMock()
monkeypatch.setattr("openvpncertupdate.CliRunner", lambda: runner)
main()
runner.regen_crl.assert_called_once_with()
def test_main_dispatches_list(monkeypatch):
monkeypatch.setattr(sys, "argv", ["prog", "--list"])
runner = MagicMock()
monkeypatch.setattr("openvpncertupdate.CliRunner", lambda: runner)
main()
runner.list_certs.assert_called_once_with(show_all=False)
def test_main_dispatches_list_all(monkeypatch):
monkeypatch.setattr(sys, "argv", ["prog", "--list-all"])
runner = MagicMock()
monkeypatch.setattr("openvpncertupdate.CliRunner", lambda: runner)
main()
runner.list_certs.assert_called_once_with(show_all=True)
def test_main_list_skips_ca_passphrase_resolution(monkeypatch):
monkeypatch.setattr(sys, "argv", ["prog", "--list"])
monkeypatch.setattr("openvpncertupdate.CliRunner", lambda: MagicMock())
mock_resolve = MagicMock()
monkeypatch.setattr("openvpncertupdate.resolve_ca_passphrase", mock_resolve)
main()
mock_resolve.assert_not_called()
def test_main_list_all_skips_ca_passphrase_resolution(monkeypatch):
monkeypatch.setattr(sys, "argv", ["prog", "--list-all"])
monkeypatch.setattr("openvpncertupdate.CliRunner", lambda: MagicMock())
mock_resolve = MagicMock()
monkeypatch.setattr("openvpncertupdate.resolve_ca_passphrase", mock_resolve)
main()
mock_resolve.assert_not_called()
def test_main_no_args_launches_tui(monkeypatch):
monkeypatch.setattr(sys, "argv", ["prog"])
app = MagicMock()
monkeypatch.setattr("openvpncertupdate.CursesApp", lambda: app)
main()
app.run.assert_called_once_with()
def test_main_resolves_ca_passphrase_before_dispatch(monkeypatch, tmp_path):
"""The configured CA_PASSPHRASE sentinel must be resolved to an actual
passphrase before any EasyRSA call, and that resolved value (not the
sentinel) must be what reaches them."""
monkeypatch.setattr(sys, "argv", ["prog", "--gen-crl"])
monkeypatch.setattr("openvpncertupdate.CA_PASSPHRASE", "!ask")
monkeypatch.setattr("openvpncertupdate.EASYRSA_DIR", "/er")
monkeypatch.setattr("openvpncertupdate.EASYRSA_PKI_DIR", str(tmp_path))
mock_gen_crl = MagicMock()
monkeypatch.setattr("openvpncertupdate.gen_crl", mock_gen_crl)
monkeypatch.setattr("openvpncertupdate.copy_crl", MagicMock())
mock_resolve = MagicMock(return_value="typed-pass")
monkeypatch.setattr("openvpncertupdate.resolve_ca_passphrase", mock_resolve)
main()
mock_resolve.assert_called_once_with("!ask", str(tmp_path))
def test_main_applies_config_overrides_before_dispatch(monkeypatch, tmp_path):
"""Overrides returned by load_settings_overrides() must land in the module
globals before EasyRSA calls, so a config file can redirect EASYRSA_PKI_DIR etc."""
monkeypatch.setattr(sys, "argv", ["prog", "--gen-crl"])
monkeypatch.setattr("openvpncertupdate.EASYRSA_DIR", "/er")
monkeypatch.setattr("openvpncertupdate.EASYRSA_PKI_DIR", "/original/pki")
monkeypatch.setattr("openvpncertupdate.CA_PASSPHRASE", "!empty")
mock_gen_crl = MagicMock()
monkeypatch.setattr("openvpncertupdate.gen_crl", mock_gen_crl)
monkeypatch.setattr("openvpncertupdate.copy_crl", MagicMock())
mock_load = MagicMock(return_value={"EASYRSA_PKI_DIR": "/overridden/pki"})
monkeypatch.setattr("openvpncertupdate.load_settings_overrides", mock_load)
main()
mock_gen_crl.assert_called_once_with("/er", "/overridden/pki", "")
def test_main_passes_config_flag_to_load_overrides(monkeypatch):
monkeypatch.setattr(sys, "argv", ["prog", "--gen-crl", "--config", "/explicit/path.conf"])
monkeypatch.setattr("openvpncertupdate.CA_PASSPHRASE", "!empty")
monkeypatch.setattr("openvpncertupdate.CliRunner", lambda: MagicMock())
mock_load = MagicMock(return_value={})
monkeypatch.setattr("openvpncertupdate.load_settings_overrides", mock_load)
main()
assert mock_load.call_args[0][0] == "/explicit/path.conf"
def test_main_exits_with_error_when_explicit_config_missing(monkeypatch, capsys):
monkeypatch.setattr(sys, "argv", ["prog", "--gen-crl", "--config", "/does/not/exist.conf"])
with pytest.raises(SystemExit) as exc_info:
main()
assert exc_info.value.code != 0
assert "/does/not/exist.conf" in capsys.readouterr().err
# ---------------------------------------------------------------------------
# --send-email / --no-send-email
# ---------------------------------------------------------------------------
def test_no_send_email_skips_delivery(monkeypatch, capsys):
mocks = _patch_issue(monkeypatch)
monkeypatch.setattr("openvpncertupdate.get_email", MagicMock(return_value=""))
CliRunner().create("alice", "alice@example.com", send_email_flag=False)
mocks["send_email"].assert_not_called()
out = capsys.readouterr().out
assert "config:" in out
def test_main_no_send_email_flag(monkeypatch):
monkeypatch.setattr(sys, "argv",
["prog", "--reissue", "bob", "--no-send-email"])
runner = MagicMock()
monkeypatch.setattr("openvpncertupdate.CliRunner", lambda: runner)
main()
runner.reissue.assert_called_once_with("bob", "", send_email_flag=False, show_eml=False)
# ---------------------------------------------------------------------------
# --show-eml
# ---------------------------------------------------------------------------
def test_show_eml_outputs_base64(monkeypatch, capsys, tmp_path):
"""--show-eml prints a non-empty base64 string to stdout."""
import base64 as _b64
# Write a minimal template and .ovpn so build_mime_message can read them
template = tmp_path / "tpl.txt"
template.write_text("Hi {cn}, url={url}, cfg={config_name}")
ovpn = tmp_path / "c.ovpn"
ovpn.write_bytes(b"ovpn-data")
mocks = _patch_issue(monkeypatch, ovpn_path=str(ovpn))
import openvpncertupdate as m
monkeypatch.setattr(m, "EMAIL_TEMPLATE_PATH", str(template))
monkeypatch.setattr(m, "build_mime_message",
m.build_mime_message) # keep real implementation
CliRunner().create("alice", "alice@example.com",
send_email_flag=False, show_eml=True)
out = capsys.readouterr().out
# Find the base64 block (before the "config:" line)
b64_line = [l for l in out.splitlines() if l and not l.startswith(("config:", "password"))][0]
decoded = _b64.b64decode(b64_line)
assert b"alice@example.com" in decoded
assert b"alice" in decoded
def test_show_eml_implies_no_send(monkeypatch, capsys):
"""--show-eml without --send-email must not call send_email."""
mocks = _patch_issue(monkeypatch)
import openvpncertupdate as m
monkeypatch.setattr(m, "build_mime_message", MagicMock(
return_value=MagicMock(as_bytes=MagicMock(return_value=b"eml"))
))
CliRunner().create("alice", "alice@example.com",
send_email_flag=False, show_eml=True)
mocks["send_email"].assert_not_called()
def test_show_eml_with_send_email_still_sends(monkeypatch, capsys):
"""--show-eml --send-email: both show eml and send."""
mocks = _patch_issue(monkeypatch)
import openvpncertupdate as m
monkeypatch.setattr(m, "build_mime_message", MagicMock(
return_value=MagicMock(as_bytes=MagicMock(return_value=b"eml"))
))
CliRunner().create("alice", "alice@example.com",
send_email_flag=True, show_eml=True)
mocks["send_email"].assert_called_once()
def test_main_show_eml_defaults_to_no_send(monkeypatch):
"""--show-eml with no explicit --send-email → send_email_flag=False."""
monkeypatch.setattr(sys, "argv",
["prog", "--create", "alice", "--email", "a@b.com", "--show-eml"])
runner = MagicMock()
monkeypatch.setattr("openvpncertupdate.CliRunner", lambda: runner)
main()
runner.create.assert_called_once_with(
"alice", "a@b.com", send_email_flag=False, show_eml=True
)
def test_main_show_eml_send_email_override(monkeypatch):
"""--show-eml --send-email → send_email_flag=True."""
monkeypatch.setattr(sys, "argv",
["prog", "--create", "alice", "--email", "a@b.com",
"--show-eml", "--send-email"])
runner = MagicMock()
monkeypatch.setattr("openvpncertupdate.CliRunner", lambda: runner)
main()
runner.create.assert_called_once_with(
"alice", "a@b.com", send_email_flag=True, show_eml=True
)
Reference in New Issue View Git Blame Copy Permalink