| 1 | // Package boxidtest stands in for AWS's instance-identity signer in tests |
| 2 | // outside package boxid: records signed by one test key, and the |
| 3 | // certificates that verify them. The key, certificate and signing are |
| 4 | // boxid/internal/signtest's, which boxid's own tests wrap too. |
| 5 | package boxidtest |
| 6 | |
| 7 | import ( |
| 8 | "crypto/x509" |
| 9 | "encoding/base64" |
| 10 | "encoding/json" |
| 11 | "testing" |
| 12 | |
| 13 | "github.com/carlosframework/platform/internal/boxid" |
| 14 | "github.com/carlosframework/platform/internal/boxid/internal/signtest" |
| 15 | ) |
| 16 | |
| 17 | // Regions are the AWS regions Certs certifies. Every region a fixture |
| 18 | // signs a record for must be here, or its box never verifies. |
| 19 | var Regions = []string{"ap-southeast-2", "eu-north-1", "eu-west-1", "eu-west-2", "us-east-1"} |
| 20 | |
| 21 | // Signer is one test's AWS. |
| 22 | type Signer struct{ s *signtest.Signer } |
| 23 | |
| 24 | // NewSigner makes a fresh key and certificate. |
| 25 | func NewSigner(t testing.TB) *Signer { |
| 26 | t.Helper() |
| 27 | return &Signer{s: signtest.New(t)} |
| 28 | } |
| 29 | |
| 30 | // Record signs an identity document for instance in account and region and |
| 31 | // returns the box's record and its exact bytes. |
| 32 | func (s *Signer) Record(t testing.TB, box, account, region, instance string) (boxid.Record, []byte) { |
| 33 | t.Helper() |
| 34 | doc, sig := s.s.Sign(t, account, region, instance) |
| 35 | rec := boxid.Record{V: 1, Box: box, IdentityDocument: base64.StdEncoding.EncodeToString(doc), |
| 36 | IdentitySignature: base64.StdEncoding.EncodeToString(sig), WrittenAt: "2026-10-06T00:00:00Z"} |
| 37 | raw, err := json.Marshal(rec) |
| 38 | if err != nil { |
| 39 | t.Fatal(err) |
| 40 | } |
| 41 | return rec, raw |
| 42 | } |
| 43 | |
| 44 | // Certs certifies every region in Regions with this signer's certificate, |
| 45 | // the shape boxid.Verifier.Certs takes. |
| 46 | func (s *Signer) Certs() map[string]*x509.Certificate { |
| 47 | out := make(map[string]*x509.Certificate, len(Regions)) |
| 48 | for _, r := range Regions { |
| 49 | out[r] = s.s.Cert |
| 50 | } |
| 51 | return out |
| 52 | } |
| 53 | |
amadan