1+ // Copyright (c) 2025, NVIDIA CORPORATION. All rights reserved.
2+ //
3+ // Licensed under the Apache License, Version 2.0 (the "License");
4+ // you may not use this file except in compliance with the License.
5+ // You may obtain a copy of the License at
6+ //
7+ // http://www.apache.org/licenses/LICENSE-2.0
8+ //
9+ // Unless required by applicable law or agreed to in writing, software
10+ // distributed under the License is distributed on an "AS IS" BASIS,
11+ // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+ // See the License for the specific language governing permissions and
13+ // limitations under the License.
14+
15+ package flags
16+
17+ import (
18+ "os"
19+ "path/filepath"
20+ "testing"
21+
22+ "github.com/stretchr/testify/assert"
23+ "github.com/stretchr/testify/require"
24+ )
25+
26+ func TestDatabaseCertConfig_ResolveCertPath (t * testing.T ) {
27+ tests := []struct {
28+ name string
29+ databaseClientCertMountPath string
30+ legacyMongoCertPath string
31+ expectedResolvedPath string
32+ description string
33+ }{
34+ {
35+ name : "new flag with default value uses legacy" ,
36+ databaseClientCertMountPath : "/etc/ssl/database-client" ,
37+ legacyMongoCertPath : "/etc/ssl/mongo-client" ,
38+ expectedResolvedPath : "/etc/ssl/mongo-client" ,
39+ description : "When new flag is default, legacy flag value should be used" ,
40+ },
41+ {
42+ name : "new flag with custom value uses new" ,
43+ databaseClientCertMountPath : "/custom/database-client" ,
44+ legacyMongoCertPath : "/etc/ssl/mongo-client" ,
45+ expectedResolvedPath : "/custom/database-client" ,
46+ description : "When new flag is explicitly set, it should be used" ,
47+ },
48+ {
49+ name : "new flag with default and legacy custom uses legacy" ,
50+ databaseClientCertMountPath : "/etc/ssl/database-client" ,
51+ legacyMongoCertPath : "/custom/mongo-client" ,
52+ expectedResolvedPath : "/custom/mongo-client" ,
53+ description : "When new flag is default and legacy is custom, legacy should be used" ,
54+ },
55+ }
56+
57+ for _ , tt := range tests {
58+ t .Run (tt .name , func (t * testing.T ) {
59+ config := & DatabaseCertConfig {
60+ DatabaseClientCertMountPath : tt .databaseClientCertMountPath ,
61+ LegacyMongoCertPath : tt .legacyMongoCertPath ,
62+ }
63+
64+ resolvedPath := config .ResolveCertPath ()
65+
66+ assert .Equal (t , tt .expectedResolvedPath , resolvedPath , tt .description )
67+ assert .Equal (t , tt .expectedResolvedPath , config .ResolvedCertPath , "ResolvedCertPath should be set" )
68+ })
69+ }
70+ }
71+
72+ func TestDatabaseCertConfig_GetCertPath (t * testing.T ) {
73+ // Create a temporary directory structure for testing
74+ tempDir , err := os .MkdirTemp ("" , "cert_test" )
75+ require .NoError (t , err )
76+ defer os .RemoveAll (tempDir )
77+
78+ // Create test certificate directories
79+ legacyPath := filepath .Join (tempDir , "mongo-client" )
80+ newPath := filepath .Join (tempDir , "database-client" )
81+ customPath := filepath .Join (tempDir , "custom" )
82+
83+ require .NoError (t , os .MkdirAll (legacyPath , 0755 ))
84+ require .NoError (t , os .MkdirAll (newPath , 0755 ))
85+ require .NoError (t , os .MkdirAll (customPath , 0755 ))
86+
87+ // Create ca.crt files in test directories
88+ require .NoError (t , os .WriteFile (filepath .Join (legacyPath , "ca.crt" ), []byte ("legacy cert" ), 0644 ))
89+ require .NoError (t , os .WriteFile (filepath .Join (newPath , "ca.crt" ), []byte ("new cert" ), 0644 ))
90+ require .NoError (t , os .WriteFile (filepath .Join (customPath , "ca.crt" ), []byte ("custom cert" ), 0644 ))
91+
92+ tests := []struct {
93+ name string
94+ resolvedPath string
95+ expectedPath string
96+ description string
97+ }{
98+ {
99+ name : "resolved path exists" ,
100+ resolvedPath : customPath ,
101+ expectedPath : customPath ,
102+ description : "When resolved path has ca.crt, it should be used" ,
103+ },
104+ {
105+ name : "resolved path missing fallback to legacy" ,
106+ resolvedPath : filepath .Join (tempDir , "nonexistent" ),
107+ expectedPath : "/etc/ssl/mongo-client" , // Falls back to hardcoded legacy path
108+ description : "When resolved path missing, should fallback to legacy path" ,
109+ },
110+ }
111+
112+ for _ , tt := range tests {
113+ t .Run (tt .name , func (t * testing.T ) {
114+ config := & DatabaseCertConfig {
115+ ResolvedCertPath : tt .resolvedPath ,
116+ }
117+
118+ certPath := config .GetCertPath ()
119+
120+ if tt .expectedPath == "/etc/ssl/mongo-client" {
121+ // For fallback cases, just check it's using the fallback logic
122+ assert .True (t , certPath == "/etc/ssl/mongo-client" || certPath == "/etc/ssl/database-client" || certPath == tt .resolvedPath ,
123+ "Should use fallback logic when resolved path doesn't exist" )
124+ } else {
125+ assert .Equal (t , tt .expectedPath , certPath , tt .description )
126+ }
127+ })
128+ }
129+ }
130+
131+ func TestDatabaseCertConfig_GetCertPath_WithRealPaths (t * testing.T ) {
132+ tests := []struct {
133+ name string
134+ resolvedPath string
135+ description string
136+ }{
137+ {
138+ name : "legacy path preference" ,
139+ resolvedPath : "/etc/ssl/mongo-client" ,
140+ description : "Should handle legacy path correctly" ,
141+ },
142+ {
143+ name : "new path preference" ,
144+ resolvedPath : "/etc/ssl/database-client" ,
145+ description : "Should handle new path correctly" ,
146+ },
147+ }
148+
149+ for _ , tt := range tests {
150+ t .Run (tt .name , func (t * testing.T ) {
151+ config := & DatabaseCertConfig {
152+ ResolvedCertPath : tt .resolvedPath ,
153+ }
154+
155+ certPath := config .GetCertPath ()
156+
157+ // Since we can't guarantee these paths exist in test environment,
158+ // just verify the function returns a reasonable path
159+ assert .NotEmpty (t , certPath , "GetCertPath should return a non-empty path" )
160+ assert .Contains (t , []string {"/etc/ssl/mongo-client" , "/etc/ssl/database-client" , tt .resolvedPath },
161+ certPath , "Should return one of the expected paths" )
162+ })
163+ }
164+ }
0 commit comments