certapi 1.1.2__tar.gz → 1.1.3__tar.gz

{certapi-1.1.2/src/certapi.egg-info → certapi-1.1.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: certapi
-Version: 1.1.2
+Version: 1.1.3
 Summary: Python Package for managing keys, request SSL certificates from ACME.
 Home-page: https://github.com/mesudip/certapi
 Author: Sudip Bhattarai

{certapi-1.1.2 → certapi-1.1.3}/setup.py

@@ -2,7 +2,7 @@ from setuptools import setup, find_packages
 
 setup(
     name="certapi",
-    version="1.1.2",
+    version="1.1.3",
     packages=find_packages(where="src"),
     package_dir={"": "src"},
     install_requires=[

{certapi-1.1.2 → certapi-1.1.3}/src/certapi/client/cert_manager_client.py

@@ -50,6 +50,7 @@ class CertManagerClient:
         renew_threshold_days: Optional[int] = None,
         skip_failing: bool = True,
         batch_domains: bool = False,
+        self_verify: bool = True,
     ) -> CertificateResponse:
         return self.obtain(
             hosts=hosts,
@@ -63,6 +64,7 @@ class CertManagerClient:
             renew_threshold_days=renew_threshold_days,
             skip_failing=skip_failing,
             batch_domains=batch_domains,
+            self_verify=self_verify,
         )
 
     def obtain(
@@ -78,6 +80,7 @@ class CertManagerClient:
         renew_threshold_days: Optional[int] = None,
         skip_failing: bool = True,
         batch_domains: bool = False,
+        self_verify: bool = True,
     ) -> CertificateResponse:
         params = {
             "hostname": hosts if isinstance(hosts, str) else hosts,
@@ -98,6 +101,7 @@ class CertManagerClient:
             params["renew_threshold_days"] = renew_threshold_days
         params["skip_failing"] = skip_failing
         params["batch_domains"] = batch_domains
+        params["self_verify"] = self_verify
 
         data = self._get("/api/obtain", params=params)
         res = CertificateResponse.from_json(data)

{certapi-1.1.2 → certapi-1.1.3}/src/certapi/manager/acme_cert_manager.py

@@ -75,6 +75,7 @@ class AcmeCertManager:
         organization: Optional[str] = None,
         user_id: Optional[str] = None,
         renew_threshold_days: Optional[int] = None,
+        self_verify: bool = True,
     ) -> CertificateResponse:
         return self.obtain(
             hosts=hosts,
@@ -86,6 +87,7 @@ class AcmeCertManager:
             organization=organization,
             user_id=user_id,
             renew_threshold_days=renew_threshold_days,
+            self_verify=self_verify,
         )
 
     def obtain(
@@ -99,6 +101,7 @@ class AcmeCertManager:
         organization: Optional[str] = None,
         user_id: Optional[str] = None,
         renew_threshold_days: Optional[int] = None,
+        self_verify: bool = True,
     ) -> CertificateResponse:
         return self._issue_certificate_internal(
             hosts=hosts,
@@ -111,6 +114,7 @@ class AcmeCertManager:
             user_id=user_id,
             renew_threshold_days=renew_threshold_days,
             batch_generator=None,
+            self_verify=self_verify,
         )
 
     def issue_certificate_in_batches(
@@ -125,6 +129,7 @@ class AcmeCertManager:
         user_id: Optional[str] = None,
         renew_threshold_days: Optional[int] = None,
         batch_generator: Callable[[List[str]], List[List[str]]] = create_safe_domain_batches,
+        self_verify: bool = True,
     ) -> CertificateResponse:
         return self._issue_certificate_internal(
             hosts=hosts,
@@ -137,6 +142,7 @@ class AcmeCertManager:
             user_id=user_id,
             renew_threshold_days=renew_threshold_days,
             batch_generator=batch_generator,
+            self_verify=self_verify,
         )
 
     def _issue_certificate_internal(
@@ -151,6 +157,7 @@ class AcmeCertManager:
         user_id: Optional[str] = None,
         renew_threshold_days: Optional[int] = None,
         batch_generator: Optional[Callable[[List[str]], List[List[str]]]] = None,
+        self_verify: bool = True,
     ) -> CertificateResponse:
         if isinstance(hosts, str):
             hosts = [hosts]
@@ -174,7 +181,12 @@ class AcmeCertManager:
             for host in missing:
                 found_store = None
                 for store in self.challenge_solvers:
-                    if store.supports_domain(host):
+                    supports_domain = (
+                        store.supports_domain_strict(host)
+                        if self_verify and hasattr(store, "supports_domain_strict")
+                        else store.supports_domain(host)
+                    )
+                    if supports_domain:
                         found_store = store
                         break
                 if found_store is not None:

{certapi-1.1.2 → certapi-1.1.3}/src/certapi/server/api.py

@@ -103,6 +103,12 @@ def create_api_resources(api_ns, cert_manager: AcmeCertManager, renew_queue_size
         default=False,
         help="Issue certificates in separate safe batches instead of one combined order",
     )
+    obtain_parser.add_argument(
+        "self_verify",
+        type=inputs.boolean,
+        default=True,
+        help="Verify local challenge reachability/ownership before attempting issuance",
+    )
 
     @api_ns.route("/obtain")
     class ObtainCert(Resource):
@@ -117,16 +123,18 @@ def create_api_resources(api_ns, cert_manager: AcmeCertManager, renew_queue_size
             args = obtain_parser.parse_args()
             hostnames = args["hostname"]
             skip_failing = args.get("skip_failing", False)
+            self_verify = args.get("self_verify", True)
 
             with lock_manager:
-                verified_hostnames = []
-                for h in hostnames:
-                    # Find the first solver that supports this domain
-                    for solver in reversed(cert_manager.challenge_solvers):
-                        if solver.supports_domain_strict(h):
-                            verified_hostnames.append(h)
+                if self_verify:
+                    verified_hostnames = []
+                    for h in hostnames:
+                        # Find the first solver that supports and can verify this domain.
+                        for solver in reversed(cert_manager.challenge_solvers):
+                            if solver.supports_domain_strict(h):
+                                verified_hostnames.append(h)
 
-                hostnames = verified_hostnames
+                    hostnames = verified_hostnames
 
                 if not hostnames and not skip_failing:
                     api_ns.abort(400, message="None of the domains are owned by this machine or could be verified")
@@ -149,6 +157,7 @@ def create_api_resources(api_ns, cert_manager: AcmeCertManager, renew_queue_size
                     organization=args["organization"],
                     user_id=args["user_id"],
                     renew_threshold_days=args.get("renew_threshold_days"),
+                    self_verify=False,
                 )
 
                 print(data)

{certapi-1.1.2 → certapi-1.1.3/src/certapi.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: certapi
-Version: 1.1.2
+Version: 1.1.3
 Summary: Python Package for managing keys, request SSL certificates from ACME.
 Home-page: https://github.com/mesudip/certapi
 Author: Sudip Bhattarai

{certapi-1.1.2 → certapi-1.1.3}/tests/test_acme_cert_manager_batching.py

@@ -22,6 +22,9 @@ class DummySolver:
     def supports_domain(self, _domain):
         return True
 
+    def supports_domain_strict(self, _domain):
+        return True
+
 
 class DummyIssuer:
     def __init__(self):
@@ -93,3 +96,34 @@ def test_issue_certificate_in_batches_uses_custom_batch_generator():
     ]
     assert len(response.issued) == 3
     assert [issued.domains for issued in response.issued] == issuer.calls
+
+
+def test_issue_certificate_self_verify_false_skips_strict_solver_check():
+    class StrictFailingSolver(DummySolver):
+        def supports_domain_strict(self, _domain):
+            return False
+
+    key_store = DummyKeyStore()
+    issuer = DummyIssuer()
+    solver = StrictFailingSolver()
+    manager = AcmeCertManager(key_store=key_store, cert_issuer=issuer, challenge_solvers=[solver])
+
+    manager.issue_certificate(hosts=["force.example.com"], self_verify=False)
+
+    assert issuer.calls == [["force.example.com"]]
+
+
+def test_issue_certificate_self_verify_true_uses_strict_solver_check():
+    class StrictFailingSolver(DummySolver):
+        def supports_domain_strict(self, _domain):
+            return False
+
+    key_store = DummyKeyStore()
+    issuer = DummyIssuer()
+    solver = StrictFailingSolver()
+    manager = AcmeCertManager(key_store=key_store, cert_issuer=issuer, challenge_solvers=[solver])
+
+    response = manager.issue_certificate(hosts=["force.example.com"])
+
+    assert issuer.calls == []
+    assert response.issued == []

{certapi-1.1.2 → certapi-1.1.3}/tests/test_obtain_interface.py

@@ -1,8 +1,12 @@
 from unittest.mock import Mock
 
+from flask import Flask
+from flask_restx import Api, Namespace
+
 from certapi.client.cert_manager_client import CertManagerClient
 from certapi.http.types import CertificateResponse
 from certapi.manager.acme_cert_manager import AcmeCertManager
+from certapi.server.api import create_api_resources
 
 
 def test_acme_cert_manager_issue_certificate_delegates_to_obtain(monkeypatch):
@@ -25,6 +29,7 @@ def test_acme_cert_manager_issue_certificate_delegates_to_obtain(monkeypatch):
         organization="Org",
         user_id="u1",
         renew_threshold_days=25,
+        self_verify=False,
     )
 
     assert res is expected
@@ -37,6 +42,7 @@ def test_acme_cert_manager_issue_certificate_delegates_to_obtain(monkeypatch):
     assert captured["organization"] == "Org"
     assert captured["user_id"] == "u1"
     assert captured["renew_threshold_days"] == 25
+    assert captured["self_verify"] is False
 
 
 def test_acme_cert_manager_obtain_uses_internal_issue_path(monkeypatch):
@@ -54,6 +60,7 @@ def test_acme_cert_manager_obtain_uses_internal_issue_path(monkeypatch):
         key_type="ecdsa",
         expiry_days=90,
         renew_threshold_days=30,
+        self_verify=False,
     )
 
     assert res is expected
@@ -62,6 +69,7 @@ def test_acme_cert_manager_obtain_uses_internal_issue_path(monkeypatch):
     assert captured["expiry_days"] == 90
     assert captured["renew_threshold_days"] == 30
     assert captured["batch_generator"] is None
+    assert captured["self_verify"] is False
 
 
 def test_cert_manager_client_issue_certificate_delegates_to_obtain(monkeypatch):
@@ -86,6 +94,7 @@ def test_cert_manager_client_issue_certificate_delegates_to_obtain(monkeypatch):
         renew_threshold_days=15,
         skip_failing=False,
         batch_domains=True,
+        self_verify=False,
     )
 
     assert res is expected
@@ -100,6 +109,7 @@ def test_cert_manager_client_issue_certificate_delegates_to_obtain(monkeypatch):
     assert captured["renew_threshold_days"] == 15
     assert captured["skip_failing"] is False
     assert captured["batch_domains"] is True
+    assert captured["self_verify"] is False
 
 
 def test_cert_manager_client_obtain_calls_api_obtain(monkeypatch):
@@ -118,6 +128,7 @@ def test_cert_manager_client_obtain_calls_api_obtain(monkeypatch):
         renew_threshold_days=12,
         skip_failing=False,
         batch_domains=True,
+        self_verify=False,
     )
 
     assert isinstance(res, CertificateResponse)
@@ -127,3 +138,57 @@ def test_cert_manager_client_obtain_calls_api_obtain(monkeypatch):
     assert captured["params"]["renew_threshold_days"] == 12
     assert captured["params"]["skip_failing"] is False
     assert captured["params"]["batch_domains"] is True
+    assert captured["params"]["self_verify"] is False
+
+
+def test_remote_obtain_self_verify_false_skips_server_prefilter():
+    app = Flask(__name__)
+    api = Api(app)
+    api_ns = Namespace("api")
+    api.add_namespace(api_ns)
+
+    class Solver:
+        def supports_domain_strict(self, _domain):
+            return False
+
+    class Manager:
+        challenge_solvers = [Solver()]
+
+        def __init__(self):
+            self.calls = []
+
+        def issue_certificate(self, hosts, **kwargs):
+            self.calls.append({"hosts": hosts, "kwargs": kwargs})
+            return CertificateResponse()
+
+    manager = Manager()
+    create_api_resources(api_ns, manager)
+
+    response = app.test_client().get("/api/obtain?hostname=force.example.com&self_verify=false")
+
+    assert response.status_code == 200
+    assert manager.calls[0]["hosts"] == ["force.example.com"]
+    assert manager.calls[0]["kwargs"]["self_verify"] is False
+
+
+def test_remote_obtain_self_verify_true_keeps_server_prefilter():
+    app = Flask(__name__)
+    api = Api(app)
+    api_ns = Namespace("api")
+    api.add_namespace(api_ns)
+
+    class Solver:
+        def supports_domain_strict(self, _domain):
+            return False
+
+    class Manager:
+        challenge_solvers = [Solver()]
+
+        def issue_certificate(self, hosts, **kwargs):
+            raise AssertionError("unverified host should not reach manager")
+
+    create_api_resources(api_ns, Manager())
+
+    response = app.test_client().get("/api/obtain?hostname=force.example.com")
+
+    assert response.status_code == 400