Add Vault certificate rotation operator

internal/rotator/opnsense_test.go

@@ -0,0 +1,58 @@
+package rotator
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+)
+
+func TestOPNsenseTransaction(t *testing.T) {
+	server := httptest.NewTLSServer(http.HandlerFunc(func(response http.ResponseWriter, request *http.Request) {
+		key, secret, ok := request.BasicAuth()
+		if !ok || key != "key" || secret != "secret" {
+			http.Error(response, "unauthorized", http.StatusUnauthorized)
+			return
+		}
+		switch request.URL.Path {
+		case "/api/webguicertificate/service/status":
+			_ = json.NewEncoder(response).Encode(activationStatus{Status: "idle", RefID: "aaaaaaaaaaaaa"})
+		case "/api/trust/cert/add":
+			_ = json.NewEncoder(response).Encode(addCertificateResponse{Result: "saved", UUID: "uuid"})
+		case "/api/trust/cert/get/uuid":
+			_ = json.NewEncoder(response).Encode(map[string]any{"cert": map[string]string{"refid": "bbbbbbbbbbbbb"}})
+		case "/api/webguicertificate/service/activate":
+			_ = json.NewEncoder(response).Encode(activationStatus{Status: "pending", Transaction: "0123456789abcdef0123456789abcdef", CandidateRefID: "bbbbbbbbbbbbb"})
+		case "/api/webguicertificate/service/confirm":
+			_ = json.NewEncoder(response).Encode(activationStatus{Status: "confirmed", RefID: "bbbbbbbbbbbbb"})
+		default:
+			http.NotFound(response, request)
+		}
+	}))
+	defer server.Close()
+
+	client := opnsenseClient{baseURL: server.URL, apiKey: "key", apiSecret: "secret", client: server.Client()}
+	status, certificate, err := client.status(context.Background())
+	if err != nil {
+		t.Fatal(err)
+	}
+	if status.RefID != "aaaaaaaaaaaaa" || certificate == nil {
+		t.Fatalf("unexpected status: %#v", status)
+	}
+
+	reference, err := client.stage(context.Background(), signedCertificate{leaf: server.Certificate(), chain: []byte("certificate"), key: []byte("private key")})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if reference != "bbbbbbbbbbbbb" {
+		t.Fatalf("unexpected reference: %s", reference)
+	}
+	activation, err := client.activate(context.Background(), reference)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := client.confirm(context.Background(), activation.Transaction); err != nil {
+		t.Fatal(err)
+	}
+}