cert_watch 1.0.0

data/lib/cert_watch/sanitize.rb

@@ -0,0 +1,13 @@
+module CertWatch
+  module Sanitize
+    extend self
+
+    class ForbiddenCharacters < Error; end
+
+    def check_domain!(name)
+      if name =~ /[^0-9a-zA-Z.-]/
+        fail(ForbiddenCharacters, "Domain '#{name}' contains forbidden characters.")
+      end
+    end
+  end
+end

data/lib/cert_watch/shell.rb

@@ -0,0 +1,20 @@
+module CertWatch
+  module Shell
+    extend self
+
+    class CommandFailed < Error; end
+
+    def sudo(command)
+      output, input = IO.pipe
+      prefix = !Rails.env.test? ? 'sudo ' : ''
+      full_command = [prefix, command].join
+
+      result = system(full_command, [:out, :err] => input)
+      input.close
+
+      unless result
+        fail(CommandFailed, "Command '#{full_command}' failed with output:\n\n#{output.read}\n")
+      end
+    end
+  end
+end

data/lib/cert_watch/version.rb

@@ -0,0 +1,3 @@
+module CertWatch
+  VERSION = '1.0.0'.freeze
+end

data/lib/cert_watch/views/all.rb

@@ -0,0 +1,3 @@
+# View components cannot be discovered via the auto loader since they
+# are never referenced by class name.
+[CertWatch::Views::CertificateState]

data/lib/cert_watch/views/certificate_state.rb

@@ -0,0 +1,42 @@
+require 'arbre'
+require 'active_admin'
+
+module CertWatch
+  module Views
+    class CertificateState < Arbre::Component
+      builder_method :cert_watch_certificate_state
+
+      STATE_MAPPING = {
+        'installed' => 'ok',
+        'installing' => 'warn',
+        'renewing' => 'warn',
+        'installing_failed' => 'error',
+        'renewing_failed' => 'error'
+      }.freeze
+
+      def build(certificate_or_domain, options = {})
+        state = get_state(certificate_or_domain)
+        format = options.fetch(:format, 'short')
+
+        add_class 'cert_watch_certificate_state'
+
+        status_tag(t(state, scope: "cert_watch.states.#{format}"),
+                   [state, STATE_MAPPING[state]].compact.join(' '))
+      end
+
+      private
+
+      def get_state(certificate_or_domain)
+        get_certificate(certificate_or_domain).try(:state) || 'not_found'
+      end
+
+      def get_certificate(certificate_or_domain)
+        if certificate_or_domain.is_a?(String)
+          Certificate.find_by_domain(certificate_or_domain)
+        else
+          certificate_or_domain
+        end
+      end
+    end
+  end
+end

data/lib/cert_watch.rb

@@ -0,0 +1,32 @@
+require 'cert_watch/engine'
+
+module CertWatch
+  def self.config
+    fail('Call CertWatch.setup before accessing CertWatch.config') unless @config
+    @config
+  end
+
+  def self.setup
+    @config = Configuration.new
+    yield @config if block_given?
+
+    self.client = CertbotClient.new(executable: config.certbot_executable,
+                                    port: config.certbot_port)
+
+    self.installer = PemDirectoryInstaller.new(pem_directory: config.pem_directory,
+                                               input_directory: config.certbot_output_directory,
+                                               reload_command: config.server_reload_command)
+  end
+
+  mattr_accessor :client
+
+  mattr_accessor :installer
+
+  def self.active_admin_load_path
+    Dir[CertWatch::Engine.root.join('admin')].first
+  end
+
+  def self.domain_owner(options)
+    DomainOwner.define(options)
+  end
+end

data/spec/cert_watch/certbot_client_spec.rb

@@ -0,0 +1,53 @@
+require 'rails_helper'
+
+module CertWatch
+  RSpec.describe CertbotClient do
+    let(:shell) do
+      instance_double('Shell', sudo: nil)
+    end
+
+    let(:client) do
+      CertbotClient.new(executable: '/usr/bin/certbot',
+                        port: 99,
+                        shell: shell)
+    end
+
+    it 'invokes given executable' do
+      client.renew('some.example.com')
+
+      expect(shell).to have_received(:sudo).with(a_string_including('/usr/bin/certbot'))
+    end
+
+    it 'passes given port' do
+      client.renew('some.example.com')
+
+      expect(shell).to have_received(:sudo).with(a_string_including('--http-01-port 99'))
+    end
+
+    it 'passes domain' do
+      client.renew('some.example.com')
+
+      expect(shell).to have_received(:sudo).with(a_string_including('-d some.example.com'))
+    end
+
+    it 'fails if domain contains forbidden characters' do
+      expect do
+        client.renew('some.example.com;" rm *')
+      end.to raise_error(Sanitize::ForbiddenCharacters)
+    end
+
+    it 'passes --renew-by-default flag' do
+      client.renew('some.example.com')
+
+      expect(shell).to have_received(:sudo).with(a_string_including('--renew-by-default'))
+    end
+
+    it 'fails with RenewError if shell command fails' do
+      allow(shell).to receive(:sudo).and_raise(Shell::CommandFailed)
+
+      expect do
+        client.renew('some.example.com')
+      end.to raise_error(RenewError)
+    end
+  end
+end

data/spec/cert_watch/domain_owner_spec.rb

@@ -0,0 +1,62 @@
+require 'rails_helper'
+
+require 'support/helpers/doubles'
+
+module CertWatch
+  RSpec.describe DomainOwner do
+    let(:test_domain_owner_model) do
+      Class.new(ActiveRecord::Base) do
+        self.table_name = :test_domain_owner
+        include CertWatch.domain_owner(attribute: :cname)
+      end
+    end
+
+    it 'renews certificate on create' do
+      test_domain_owner_model.create!(cname: 'new.example.com')
+
+      certificate = Certificate.find_by_domain('new.example.com')
+
+      expect(certificate).to be_present
+      expect(certificate.state).to eq('renewing')
+    end
+
+    it 'renews certificate on update' do
+      domain_owner = test_domain_owner_model.create!(cname: 'old.example.com')
+
+      domain_owner.update!(cname: 'new.example.com')
+      certificate = Certificate.find_by_domain('new.example.com')
+
+      expect(certificate).to be_present
+      expect(certificate.state).to eq('renewing')
+    end
+
+    it 'does not renew certificate when cname is unchanged' do
+      domain_owner = test_domain_owner_model.create!(name: 'Old', cname: 'some.example.com')
+      certificate = Certificate.find_by_domain!('some.example.com')
+      certificate.update!(state: 'installed')
+
+      domain_owner.update!(name: 'New')
+
+      expect(certificate.reload.state).to eq('installed')
+    end
+
+    it 'does not create certificate when new cname is blank' do
+      domain_owner = test_domain_owner_model.create!(name: 'Old', cname: 'some.example.com')
+      certificate = Certificate.find_by_domain!('some.example.com')
+      certificate.update!(state: 'installed')
+
+      expect do
+        domain_owner.update!(cname: '')
+      end.not_to change { Certificate.count }
+    end
+
+    it 'abandons old certificate on update' do
+      domain_owner = test_domain_owner_model.create!(cname: 'old.example.com')
+
+      domain_owner.update!(cname: 'new.example.com')
+      certificate = Certificate.find_by_domain('old.example.com')
+
+      expect(certificate.state).to eq('abandoned')
+    end
+  end
+end

data/spec/cert_watch/pem_directory_installer_spec.rb

@@ -0,0 +1,75 @@
+require 'rails_helper'
+
+module CertWatch
+  RSpec.describe PemDirectoryInstaller, fixture_files: true do
+    before do
+      Fixtures.file('live/some.example.com/fullchain.pem', "FULL CHAIN\n")
+      Fixtures.file('live/some.example.com/privkey.pem', "PRIVATE KEY\n")
+      Fixtures.directory('ssl')
+    end
+
+    it 'concatenates full chain and private key files' do
+      installer = PemDirectoryInstaller.new(input_directory: 'live',
+                                            pem_directory: 'ssl',
+                                            reload_command: 'touch reload.txt')
+      installer.install('some.example.com')
+
+      expect(File.read('ssl/some.example.com.pem')).to eq("FULL CHAIN\nPRIVATE KEY\n")
+    end
+
+    it 'invokes reload command' do
+      installer = PemDirectoryInstaller.new(input_directory: 'live',
+                                            pem_directory: 'ssl',
+                                            reload_command: 'touch reload.txt')
+      installer.install('some.example.com')
+
+      expect(File.exist?('reload.txt')).to eq(true)
+    end
+
+    it 'fails with InstallError if reload command fails' do
+      installer = PemDirectoryInstaller.new(input_directory: 'live',
+                                            pem_directory: 'ssl',
+                                            reload_command: './not_there')
+      expect do
+        installer.install('some.example.com')
+      end.to raise_error(InstallError)
+    end
+
+    it 'fails with InstallError if input files not found' do
+      installer = PemDirectoryInstaller.new(input_directory: 'live',
+                                            pem_directory: 'ssl')
+      expect do
+        installer.install('not-there.example.com')
+      end.to raise_error(InstallError)
+    end
+
+    it 'does not create output file if input files not found' do
+      installer = PemDirectoryInstaller.new(input_directory: 'live',
+                                            pem_directory: 'ssl')
+
+      begin
+        installer.install('not-there.example.com')
+      rescue InstallError
+      end
+
+      expect(File.exist?('ssl/not-there.example.com.pem')).to eq(false)
+    end
+
+    it 'fails with InstallError if output directory does not exist' do
+      installer = PemDirectoryInstaller.new(input_directory: 'live',
+                                            pem_directory: 'not-there')
+      expect do
+        installer.install('some.example.com')
+      end.to raise_error(InstallError)
+    end
+
+    it 'fails if domain contains forbidden characters' do
+      installer = PemDirectoryInstaller.new(input_directory: 'live',
+                                            pem_directory: 'ssl')
+
+      expect do
+        installer.install('some.*example ".com')
+      end.to raise_error(Sanitize::ForbiddenCharacters)
+    end
+  end
+end

data/spec/cert_watch/sanitize_spec.rb

@@ -0,0 +1,19 @@
+require 'rails_helper'
+
+module CertWatch
+  RSpec.describe Sanitize do
+    describe '.check_domain!' do
+      it 'fails if string contains forbidden characters' do
+        expect do
+          Sanitize.check_domain!('some.12-; rm *"')
+        end.to raise_error(Sanitize::ForbiddenCharacters)
+      end
+
+      it 'handles multi line strings' do
+        expect do
+          Sanitize.check_domain!("valid\n rm *")
+        end.to raise_error(Sanitize::ForbiddenCharacters)
+      end
+    end
+  end
+end

data/spec/cert_watch/shell_spec.rb

@@ -0,0 +1,19 @@
+require 'rails_helper'
+
+module CertWatch
+  RSpec.describe Shell, fixture_files: true do
+    describe '.sudo' do
+      it 'runs given command' do
+        Shell.sudo('echo "test" > foo')
+
+        expect(File.read('foo')).to eq("test\n")
+      end
+
+      it 'raises CommandFailed with output if command fails' do
+        expect do
+          Shell.sudo('LANG=en touch not/there')
+        end.to raise_error(Shell::CommandFailed, /cannot touch/)
+      end
+    end
+  end
+end

data/spec/cert_watch/views/certificate_state_spec.rb

@@ -0,0 +1,33 @@
+require 'rails_helper'
+
+module CertWatch
+  module Views
+    RSpec.describe CertificateState, type: :view_component do
+      context 'with string argument' do
+        it 'renders status tag for matching certificate' do
+          create(:certificate, state: 'installed', domain: 'my.example.com')
+
+          render(:cert_watch_certificate_state, 'my.example.com')
+
+          expect(rendered).to have_selector('.status_tag.installed')
+        end
+
+        it 'renders status tag if certificate is not found' do
+          render(:cert_watch_certificate_state, 'not.there.com')
+
+          expect(rendered).to have_selector('.status_tag.not_found')
+        end
+      end
+
+      context 'with certificate argument' do
+        it 'renders status tag for certificate' do
+          certificate = create(:certificate, state: 'installed', domain: 'my.example.com')
+
+          render(:cert_watch_certificate_state, certificate)
+
+          expect(rendered).to have_selector('.status_tag.installed')
+        end
+      end
+    end
+  end
+end

data/spec/examples.txt

@@ -0,0 +1,40 @@
+example_id                                                          | status | run_time        |
+------------------------------------------------------------------- | ------ | --------------- |
+./spec/cert_watch/certbot_client_spec.rb[1:1]                       | passed | 0.00682 seconds |
+./spec/cert_watch/certbot_client_spec.rb[1:2]                       | passed | 0.00204 seconds |
+./spec/cert_watch/certbot_client_spec.rb[1:3]                       | passed | 0.00203 seconds |
+./spec/cert_watch/certbot_client_spec.rb[1:4]                       | passed | 0.00201 seconds |
+./spec/cert_watch/certbot_client_spec.rb[1:5]                       | passed | 0.00223 seconds |
+./spec/cert_watch/certbot_client_spec.rb[1:6]                       | passed | 0.0029 seconds  |
+./spec/cert_watch/domain_owner_spec.rb[1:1]                         | passed | 0.04831 seconds |
+./spec/cert_watch/domain_owner_spec.rb[1:2]                         | passed | 0.07414 seconds |
+./spec/cert_watch/domain_owner_spec.rb[1:3]                         | passed | 0.06987 seconds |
+./spec/cert_watch/domain_owner_spec.rb[1:4]                         | passed | 0.08508 seconds |
+./spec/cert_watch/domain_owner_spec.rb[1:5]                         | passed | 0.08109 seconds |
+./spec/cert_watch/pem_directory_installer_spec.rb[1:1]              | passed | 0.03524 seconds |
+./spec/cert_watch/pem_directory_installer_spec.rb[1:2]              | passed | 0.05051 seconds |
+./spec/cert_watch/pem_directory_installer_spec.rb[1:3]              | passed | 0.03625 seconds |
+./spec/cert_watch/pem_directory_installer_spec.rb[1:4]              | passed | 0.01778 seconds |
+./spec/cert_watch/pem_directory_installer_spec.rb[1:5]              | passed | 0.02905 seconds |
+./spec/cert_watch/pem_directory_installer_spec.rb[1:6]              | passed | 0.02549 seconds |
+./spec/cert_watch/pem_directory_installer_spec.rb[1:7]              | passed | 0.00437 seconds |
+./spec/cert_watch/sanitize_spec.rb[1:1:1]                           | passed | 0.00192 seconds |
+./spec/cert_watch/sanitize_spec.rb[1:1:2]                           | passed | 0.00219 seconds |
+./spec/cert_watch/shell_spec.rb[1:1:1]                              | passed | 0.01215 seconds |
+./spec/cert_watch/shell_spec.rb[1:1:2]                              | passed | 0.01372 seconds |
+./spec/cert_watch/views/certificate_state_spec.rb[1:1:1]            | passed | 0.0096 seconds  |
+./spec/cert_watch/views/certificate_state_spec.rb[1:1:2]            | passed | 0.00646 seconds |
+./spec/cert_watch/views/certificate_state_spec.rb[1:2:1]            | passed | 0.03833 seconds |
+./spec/jobs/cert_watch/renew_expiring_certificates_job_spec.rb[1:1] | passed | 0.01287 seconds |
+./spec/jobs/cert_watch/renew_expiring_certificates_job_spec.rb[1:2] | passed | 0.0086 seconds  |
+./spec/jobs/cert_watch/renew_expiring_certificates_job_spec.rb[1:3] | passed | 0.0154 seconds  |
+./spec/jobs/cert_watch/renew_expiring_certificates_job_spec.rb[1:4] | passed | 0.01655 seconds |
+./spec/models/cert_watch/certificate_spec.rb[1:1:1]                 | passed | 0.01814 seconds |
+./spec/models/cert_watch/certificate_spec.rb[1:1:2]                 | passed | 0.03732 seconds |
+./spec/models/cert_watch/certificate_spec.rb[1:1:3]                 | passed | 0.01962 seconds |
+./spec/models/cert_watch/certificate_spec.rb[1:1:4]                 | passed | 0.02037 seconds |
+./spec/models/cert_watch/certificate_spec.rb[1:1:5]                 | passed | 0.01938 seconds |
+./spec/models/cert_watch/certificate_spec.rb[1:1:6:1]               | passed | 0.01556 seconds |
+./spec/models/cert_watch/certificate_spec.rb[1:1:6:2]               | passed | 0.01882 seconds |
+./spec/models/cert_watch/certificate_spec.rb[1:1:7:1]               | passed | 0.02004 seconds |
+./spec/models/cert_watch/certificate_spec.rb[1:1:7:2]               | passed | 0.02153 seconds |

data/spec/factories/certificates.rb

@@ -0,0 +1,6 @@
+FactoryGirl.define do
+  factory(:certificate, class: CertWatch::Certificate) do
+    domain 'some.example.com'
+    state 'not_installed'
+  end
+end

data/spec/internal/config/database.yml

@@ -0,0 +1,3 @@
+test:
+  adapter:  sqlite3
+  database: db/combustion_test.sqlite

data/spec/internal/config/routes.rb

@@ -0,0 +1,3 @@
+Rails.application.routes.draw do
+  #
+end

data/spec/internal/db/schema.rb

@@ -0,0 +1,7 @@
+ActiveRecord::Schema.define do
+  create_table(:test_domain_owner, force: true) do |t|
+    t.string :name
+    t.string :cname
+    t.timestamps null: false
+  end
+end