chore: 恢复旧布局基线（迁移改动丢失后重建，apps/packages 布局暂存）

2026-10-14 20:31:17 +08:00
1 parent a9510235bb
commit 456fa6954b
@@ -0,0 +1,183 @@
+package db
+
+import (
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"encoding/pem"
+	"math/big"
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+)
+
+func TestEffectiveSSLMode(t *testing.T) {
+	if got := EffectiveSSLMode(ConnReq{}); got != "disable" {
+		t.Fatalf("empty -> disable, got %s", got)
+	}
+	if got := EffectiveSSLMode(ConnReq{SSL: true}); got != "require" {
+		t.Fatalf("ssl true -> require, got %s", got)
+	}
+	if got := EffectiveSSLMode(ConnReq{SSL: true, SSLMode: "skip-verify"}); got != "skip-verify" {
+		t.Fatalf("mode wins, got %s", got)
+	}
+	if got := EffectiveSSLMode(ConnReq{SSL: true, SSLMode: "disable"}); got != "disable" {
+		t.Fatalf("explicit disable, got %s", got)
+	}
+	if !SSLEnabled(ConnReq{SSLMode: "require"}) {
+		t.Fatal("require should enable")
+	}
+}
+
+func TestTLSConfigFromDisable(t *testing.T) {
+	cfg, err := tlsConfigFrom(ConnReq{})
+	if err != nil || cfg != nil {
+		t.Fatalf("disable => nil,nil got %#v %v", cfg, err)
+	}
+}
+
+func TestTLSConfigFromSkipVerify(t *testing.T) {
+	cfg, err := tlsConfigFrom(ConnReq{SSL: true, SSLMode: "skip-verify", Host: "db.example"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if cfg == nil || !cfg.InsecureSkipVerify {
+		t.Fatalf("expected InsecureSkipVerify, got %#v", cfg)
+	}
+	if cfg.ServerName != "db.example" {
+		t.Fatalf("ServerName %q", cfg.ServerName)
+	}
+}
+
+func TestTLSConfigFromVerifyCARequiresPath(t *testing.T) {
+	_, err := tlsConfigFrom(ConnReq{SSLMode: "verify-ca"})
+	if err == nil {
+		t.Fatal("expected error without CA")
+	}
+}
+
+func TestTLSConfigFromVerifyCAWithPEM(t *testing.T) {
+	dir := t.TempDir()
+	caPath := filepath.Join(dir, "ca.pem")
+	if err := writeTestCA(caPath); err != nil {
+		t.Fatal(err)
+	}
+	cfg, err := tlsConfigFrom(ConnReq{SSLMode: "verify-ca", SSLCA: caPath, Host: "127.0.0.1"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if cfg == nil || cfg.RootCAs == nil {
+		t.Fatal("expected RootCAs")
+	}
+	if cfg.VerifyPeerCertificate == nil {
+		t.Fatal("expected custom verify for verify-ca")
+	}
+}
+
+func TestTLSConfigFromBadCAPath(t *testing.T) {
+	_, err := tlsConfigFrom(ConnReq{SSLMode: "require", SSLCA: "/no/such/ca.pem"})
+	if err == nil {
+		t.Fatal("expected read error")
+	}
+}
+
+// R2-B1:显式 tlsServerName 优先于 Host(tlsConfigFrom 层)。
+func TestTLSConfigFromTLSServerName(t *testing.T) {
+	cfg, err := tlsConfigFrom(ConnReq{SSLMode: "require", Host: "127.0.0.1", TLSServerName: "db.example.com"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if cfg == nil || cfg.ServerName != "db.example.com" {
+		t.Fatalf("ServerName 应取 tlsServerName, got %#v", cfg)
+	}
+}
+
+// R2-B2:CA/客户端证书内容优先于路径;成对校验仍然生效。
+func TestTLSConfigFromContentCerts(t *testing.T) {
+	caPEM, certPEM, keyPEM := genTestCertMaterials(t)
+
+	cfg, err := tlsConfigFrom(ConnReq{
+		SSLMode: "require", Host: "db.example.com",
+		SSLCAContent: caPEM, SSLCertContent: certPEM, SSLKeyContent: keyPEM,
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if cfg == nil || cfg.RootCAs == nil {
+		t.Fatal("内容 CA 应构建 RootCAs")
+	}
+	if len(cfg.Certificates) != 1 {
+		t.Fatal("内容客户端证书应加载")
+	}
+	if cfg.ServerName != "db.example.com" {
+		t.Fatalf("ServerName 错误: %q", cfg.ServerName)
+	}
+
+	// 内容 CA 非法 PEM 应报错(不回退路径)
+	if _, err := tlsConfigFrom(ConnReq{SSLMode: "require", SSLCAContent: "not-a-pem"}); err == nil {
+		t.Fatal("非法 CA 内容应报错")
+	}
+	// 证书与密钥仍需成对:只给内容证书不给内容密钥
+	if _, err := tlsConfigFrom(ConnReq{SSLMode: "require", SSLCertContent: certPEM}); err == nil {
+		t.Fatal("半对内容证书应报错")
+	}
+}
+
+// genTestCertMaterials 生成自签名 CA 与客户端证书 PEM 串。
+func genTestCertMaterials(t *testing.T) (caPEM, certPEM, keyPEM string) {
+	t.Helper()
+	key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	if err != nil {
+		t.Fatal(err)
+	}
+	keyDER, err := x509.MarshalECPrivateKey(key)
+	if err != nil {
+		t.Fatal(err)
+	}
+	keyPEM = string(pem.EncodeToMemory(&pem.Block{Type: "EC PRIVATE KEY", Bytes: keyDER}))
+
+	tmpl := &x509.Certificate{
+		SerialNumber:          big.NewInt(2),
+		Subject:               pkix.Name{CommonName: "opsxdb-test-cert"},
+		NotBefore:             time.Now().Add(-time.Hour),
+		NotAfter:              time.Now().Add(24 * time.Hour),
+		KeyUsage:              x509.KeyUsageDigitalSignature,
+		ExtKeyUsage:           []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth},
+		BasicConstraintsValid: true,
+	}
+	der, err := x509.CreateCertificate(rand.Reader, tmpl, tmpl, &key.PublicKey, key)
+	if err != nil {
+		t.Fatal(err)
+	}
+	certPEM = string(pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: der}))
+	return certPEM, certPEM, keyPEM // 自签名,CA 与客户端证书同一张
+}
+
+func writeTestCA(path string) error {
+	key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	if err != nil {
+		return err
+	}
+	tmpl := &x509.Certificate{
+		SerialNumber:          big.NewInt(1),
+		Subject:               pkix.Name{CommonName: "opsxdb-test-ca"},
+		NotBefore:             time.Now().Add(-time.Hour),
+		NotAfter:              time.Now().Add(24 * time.Hour),
+		IsCA:                  true,
+		KeyUsage:              x509.KeyUsageCertSign | x509.KeyUsageDigitalSignature,
+		BasicConstraintsValid: true,
+	}
+	der, err := x509.CreateCertificate(rand.Reader, tmpl, tmpl, &key.PublicKey, key)
+	if err != nil {
+		return err
+	}
+	f, err := os.Create(path)
+	if err != nil {
+		return err
+	}
+	defer f.Close()
+	return pem.Encode(f, &pem.Block{Type: "CERTIFICATE", Bytes: der})
+}