certbot-dns-tencent 0.1.0__tar.gz

certbot_dns_tencent-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 TiyeeJiang
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

certbot_dns_tencent-0.1.0/PKG-INFO

@@ -0,0 +1,104 @@
+Metadata-Version: 2.4
+Name: certbot-dns-tencent
+Version: 0.1.0
+Summary: 腾讯云 DNSPod 插件，用于 Certbot 的 DNS-01 验证
+Author-email: tiyee <tiyee@live.com>
+License: MIT
+Project-URL: Homepage, https://github.com/iDigimon/certbot-dns-tencent
+Project-URL: Repository, https://github.com/iDigimon/certbot-dns-tencent
+Project-URL: Issues, https://github.com/iDigimon/certbot-dns-tencent/issues
+Project-URL: Documentation, https://github.com/iDigimon/certbot-dns-tencent/blob/main/README.md
+Keywords: certbot-dns,certbot-plugin,certbot-dns-plugin,certbot-dns-authenticator,certbot-tencent,dnspod
+Classifier: Development Status :: 4 - Beta
+Classifier: Environment :: Plugins
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Intended Audience :: System Administrators
+Classifier: Operating System :: POSIX
+Classifier: Operating System :: POSIX :: Linux
+Classifier: Programming Language :: Python
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.8
+Classifier: Programming Language :: Python :: 3.9
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Internet :: WWW/HTTP
+Classifier: Topic :: Security
+Classifier: Topic :: System :: Installation/Setup
+Classifier: Topic :: System :: Networking
+Classifier: Topic :: System :: Systems Administration
+Classifier: Topic :: Utilities
+Requires-Python: >=3.8
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: certbot>=3.0.0
+Requires-Dist: zope
+Requires-Dist: tencentcloud-sdk-python-dnspod>=3.1.0
+Dynamic: license-file
+
+# Certbot DNS 腾讯云插件
+
+这是一个用于 Certbot 的腾讯云 DNSPod 插件，支持通过腾讯云 DNSPod API 进行 DNS-01 验证来获取 SSL 证书。支持泛域名。
+
+## 功能特性
+
+- 支持通过腾讯云 DNSPod API 自动管理 DNS 记录
+- 支持泛域名
+- 支持 certbot 3 版本（更低版本未测试）
+- 兼容 Python 3.8+ 版本
+- 支持 DNS-01 验证方式
+- 自动清理临时 DNS 记录
+- 完善的错误处理和日志记录
+
+## 安装
+
+### 从 PyPI 安装
+
+```bash
+pip3 install certbot-dns-tencent
+```
+
+## 配置文件
+
+```ini
+dns_tencent_secret_id = ??
+dns_tencent_secret_key = ??
+```
+
+修改配置文件权限（假如文件是 `~/tencent.ini`）：
+
+```bash
+chmod 600 ~/tencent.ini
+```
+
+## 运行
+
+```bash
+certbot certonly \
+  --authenticator dns-tencent \
+  --dns-tencent-credentials ~/tencent.ini \
+  --dns-tencent-propagation-seconds 30 \
+  -d "*.example.com" \
+  -d "example.com"
+```
+
+## 腾讯云权限配置
+
+确保您的腾讯云 API 密钥（SecretId / SecretKey）具有 DNSPod 的管理权限：
+
+`QcloudDNSPodFullAccess`，或自定义策略包含以下操作：
+
+- `dnspod:CreateRecord`
+- `dnspod:DeleteRecord`
+- `dnspod:DescribeRecordList`
+
+## 单元测试
+
+```bash
+python -m unittest discover -s tests -p "test_*.py" -v
+```
+
+## 自动部署
+
+此程序只是 certbot 的 DNS 验证插件，如果需要自动运行申请部署，可以使用 [AutoCert](https://github.com/tiyee/AutoCert)。

certbot_dns_tencent-0.1.0/README.md

@@ -0,0 +1,65 @@
+# Certbot DNS 腾讯云插件
+
+这是一个用于 Certbot 的腾讯云 DNSPod 插件，支持通过腾讯云 DNSPod API 进行 DNS-01 验证来获取 SSL 证书。支持泛域名。
+
+## 功能特性
+
+- 支持通过腾讯云 DNSPod API 自动管理 DNS 记录
+- 支持泛域名
+- 支持 certbot 3 版本（更低版本未测试）
+- 兼容 Python 3.8+ 版本
+- 支持 DNS-01 验证方式
+- 自动清理临时 DNS 记录
+- 完善的错误处理和日志记录
+
+## 安装
+
+### 从 PyPI 安装
+
+```bash
+pip3 install certbot-dns-tencent
+```
+
+## 配置文件
+
+```ini
+dns_tencent_secret_id = ??
+dns_tencent_secret_key = ??
+```
+
+修改配置文件权限（假如文件是 `~/tencent.ini`）：
+
+```bash
+chmod 600 ~/tencent.ini
+```
+
+## 运行
+
+```bash
+certbot certonly \
+  --authenticator dns-tencent \
+  --dns-tencent-credentials ~/tencent.ini \
+  --dns-tencent-propagation-seconds 30 \
+  -d "*.example.com" \
+  -d "example.com"
+```
+
+## 腾讯云权限配置
+
+确保您的腾讯云 API 密钥（SecretId / SecretKey）具有 DNSPod 的管理权限：
+
+`QcloudDNSPodFullAccess`，或自定义策略包含以下操作：
+
+- `dnspod:CreateRecord`
+- `dnspod:DeleteRecord`
+- `dnspod:DescribeRecordList`
+
+## 单元测试
+
+```bash
+python -m unittest discover -s tests -p "test_*.py" -v
+```
+
+## 自动部署
+
+此程序只是 certbot 的 DNS 验证插件，如果需要自动运行申请部署，可以使用 [AutoCert](https://github.com/tiyee/AutoCert)。

certbot_dns_tencent-0.1.0/certbot_dns_tencent/__init__.py

@@ -0,0 +1,5 @@
+"""
+腾讯云 DNSPod 插件，用于 Certbot 的 DNS-01 验证
+"""
+
+__version__ = "0.1.0"

certbot_dns_tencent-0.1.0/certbot_dns_tencent/dns_tencent.py

@@ -0,0 +1,197 @@
+"""
+腾讯云 DNSPod 认证器插件
+"""
+
+import logging
+import time
+from typing import Any, Callable, Optional
+
+import zope.interface
+from certbot import errors, interfaces
+from certbot.plugins import dns_common
+
+from .tencent_client import TencentCloudDNSClient
+
+logger = logging.getLogger(__name__)
+
+
+@zope.interface.implementer(interfaces.IAuthenticator)
+@zope.interface.provider(interfaces.IPluginFactory)
+class Authenticator(dns_common.DNSAuthenticator):
+    """腾讯云 DNSPod 认证器"""
+
+    description = "通过腾讯云 DNSPod API 获取证书，使用 DNS-01 验证"
+    ttl = 600  # DNS 记录 TTL
+
+    def __init__(self, *args: Any, **kwargs: Any) -> None:
+        super().__init__(*args, **kwargs)
+        self.credentials: Optional[dns_common.CredentialsConfiguration] = None
+
+    @classmethod
+    def add_parser_arguments(cls, add: Callable[..., None], default_propagation_seconds: int = 30) -> None:
+        """添加命令行参数"""
+        super().add_parser_arguments(add, default_propagation_seconds)
+        add("credentials", help="腾讯云 API 凭证文件路径")
+
+    def more_info(self) -> str:
+        """返回插件的更多信息"""
+        return (
+            "此插件通过腾讯云 DNSPod API 配置 DNS 记录来完成 DNS-01 验证。"
+            "需要在凭证文件中配置腾讯云 SecretId 和 SecretKey。"
+        )
+
+    def _setup_credentials(self) -> None:
+        """设置 API 凭证"""
+        self.credentials = self._configure_credentials(
+            "credentials",
+            "腾讯云 API 凭证文件路径",
+            {
+                "secret_id": "腾讯云 SecretId",
+                "secret_key": "腾讯云 SecretKey",
+            }
+        )
+
+    def _perform(self, domain: str, validation_name: str, validation: str) -> None:
+        """
+        添加 DNS TXT 记录进行验证
+
+        :param domain: 要验证的域名
+        :param validation_name: 验证记录名称
+        :param validation: 验证值
+        """
+        self._get_tencent_client().add_txt_record(validation_name, validation)
+
+    def _cleanup(self, domain: str, validation_name: str, validation: str) -> None:
+        """
+        清理 DNS TXT 记录
+
+        :param domain: 要验证的域名
+        :param validation_name: 验证记录名称
+        :param validation: 验证值
+        """
+        self._get_tencent_client().del_txt_record(validation_name, validation)
+
+    def _get_tencent_client(self) -> "_TencentCloudDNSHelper":
+        """获取腾讯云 DNS 客户端"""
+        if not self.credentials:
+            raise errors.Error("凭证未配置")
+
+        secret_id = self.credentials.conf("secret_id")
+        secret_key = self.credentials.conf("secret_key")
+
+        return _TencentCloudDNSHelper(secret_id, secret_key, self.ttl)
+
+
+def _get_rr_from_record_name(record_name: str, domain: str) -> str:
+    """
+    从记录名称获取主机记录（DNSPod 的 SubDomain）
+
+    :param record_name: 完整的记录名称
+    :param domain: 根域名
+    :return: 主机记录
+    """
+    if record_name.endswith("." + domain):
+        rr = record_name[: -len(domain) - 1]
+    else:
+        rr = record_name
+
+    return rr
+
+
+class _TencentCloudDNSHelper:
+    """腾讯云 DNS 辅助类"""
+
+    def __init__(self, secret_id: str, secret_key: str, ttl: int):
+        """
+        初始化 DNS 辅助类
+
+        :param secret_id: 腾讯云 SecretId
+        :param secret_key: 腾讯云 SecretKey
+        :param ttl: DNS 记录 TTL
+        """
+        self.client = TencentCloudDNSClient(secret_id, secret_key)
+        self.ttl = ttl
+        self._record_ids = {}  # 存储添加的记录 ID，用于清理
+
+    def add_txt_record(self, record_name: str, record_content: str) -> None:
+        """
+        添加 TXT 记录
+
+        :param record_name: 记录名称
+        :param record_content: 记录内容
+        """
+        domain = self._get_domain_from_record_name(record_name)
+        rr = _get_rr_from_record_name(record_name, domain)
+
+        logger.debug(f"添加 TXT 记录: {record_name} -> {record_content}")
+
+        try:
+            # 检查是否已存在相同的记录
+            existing_records = self.client.get_domain_records(domain, rr, "TXT")
+            for record in existing_records:
+                if record["value"] == record_content:
+                    logger.info(f"TXT 记录已存在: {record_name}")
+                    self._record_ids[record_name] = record["record_id"]
+                    return
+
+            # 添加新记录
+            record_id = self.client.add_domain_record(domain, rr, "TXT", record_content, self.ttl)
+            self._record_ids[record_name] = record_id
+
+            # 等待 DNS 传播
+            time.sleep(10)
+
+        except Exception as e:
+            logger.error(f"添加 TXT 记录失败: {e}")
+            raise errors.PluginError(f"添加 TXT 记录失败: {e}")
+
+    def del_txt_record(self, record_name: str, record_content: str) -> None:
+        """
+        删除 TXT 记录
+
+        :param record_name: 记录名称
+        :param record_content: 记录内容
+        """
+        logger.debug(f"删除 TXT 记录: {record_name}")
+
+        try:
+            # 优先使用存储的记录 ID 删除
+            if record_name in self._record_ids:
+                record_id = self._record_ids[record_name]
+                domain = self._get_domain_from_record_name(record_name)
+                self.client.delete_domain_record(domain, record_id)
+                del self._record_ids[record_name]
+                return
+
+            # 如果没有存储的记录 ID，尝试查找并删除
+            domain = self._get_domain_from_record_name(record_name)
+            rr = _get_rr_from_record_name(record_name, domain)
+
+            existing_records = self.client.get_domain_records(domain, rr, "TXT")
+            for record in existing_records:
+                if record["value"] == record_content:
+                    self.client.delete_domain_record(domain, record["record_id"])
+                    break
+            else:
+                logger.warning(f"未找到要删除的 TXT 记录: {record_name}")
+
+        except Exception as e:
+            logger.error(f"删除 TXT 记录失败: {e}")
+            # 清理时的错误不应该导致程序失败
+            logger.warning(f"清理 TXT 记录时出错，但不影响证书获取: {e}")
+
+    @staticmethod
+    def _get_domain_from_record_name(record_name: str) -> str:
+        """
+        从记录名称获取域名
+
+        :param record_name: 完整的记录名称
+        :return: 根域名
+        """
+        # 移除 _acme-challenge. 前缀
+        if record_name.startswith("_acme-challenge."):
+            domain = record_name[16:]  # 移除 "_acme-challenge." 前缀
+        else:
+            domain = record_name
+
+        return TencentCloudDNSClient.get_root_domain(domain)

certbot_dns_tencent-0.1.0/certbot_dns_tencent/tencent_client.py

@@ -0,0 +1,148 @@
+"""
+腾讯云 DNSPod API 客户端
+"""
+
+import logging
+from typing import Any, Dict, List
+
+from tencentcloud.common import credential
+from tencentcloud.common.profile.client_profile import ClientProfile
+from tencentcloud.common.profile.http_profile import HttpProfile
+from tencentcloud.dnspod.v20210323 import dnspod_client, models
+
+logger = logging.getLogger(__name__)
+
+# DNSPod 默认解析线路名称
+DEFAULT_RECORD_LINE = "默认"
+
+
+class TencentCloudDNSClient:
+    """腾讯云 DNSPod 客户端"""
+
+    def __init__(self, secret_id: str, secret_key: str):
+        """
+        初始化腾讯云 DNSPod 客户端
+
+        :param secret_id: 腾讯云 SecretId
+        :param secret_key: 腾讯云 SecretKey
+        """
+        self.secret_id = secret_id
+        self.secret_key = secret_key
+        self.client = self._create_client()
+
+    def _create_client(self) -> dnspod_client.DnspodClient:
+        """创建 DNSPod 客户端"""
+        cred = credential.Credential(self.secret_id, self.secret_key)
+        http_profile = HttpProfile(endpoint="dnspod.tencentcloudapi.com")
+        client_profile = ClientProfile(httpProfile=http_profile)
+        # DNSPod 是非区域性服务，region 传空字符串即可
+        return dnspod_client.DnspodClient(cred, "", client_profile)
+
+    def get_domain_records(
+        self, domain_name: str, sub_domain: str, record_type: str = "TXT"
+    ) -> List[Dict[str, Any]]:
+        """
+        获取域名记录
+
+        :param domain_name: 主域名
+        :param sub_domain: 主机记录
+        :param record_type: 记录类型
+        :return: 记录列表
+        """
+        try:
+            # 腾讯云 SDK 的请求对象构造函数无参，需先实例化再逐个赋值
+            request = models.DescribeRecordListRequest()
+            request.Domain = domain_name
+            request.SubDomain = sub_domain
+            request.RecordType = record_type
+            # 查无记录时不报错，便于做幂等的“先查后加”判断
+            request.ErrorOnEmpty = "no"
+            response = self.client.DescribeRecordList(request)
+
+            if response.RecordList:
+                return [
+                    {
+                        "record_id": record.RecordId,
+                        "sub_domain": record.Name,
+                        "type": record.Type,
+                        "value": record.Value,
+                        "ttl": record.TTL,
+                        "line": record.Line,
+                    }
+                    for record in response.RecordList
+                ]
+            return []
+        except Exception as e:
+            logger.error(f"获取域名记录失败: {e}")
+            raise
+
+    def add_domain_record(
+        self,
+        domain_name: str,
+        sub_domain: str,
+        record_type: str,
+        value: str,
+        ttl: int = 600,
+    ) -> int:
+        """
+        添加域名记录
+
+        :param domain_name: 主域名
+        :param sub_domain: 主机记录
+        :param record_type: 记录类型
+        :param value: 记录值
+        :param ttl: TTL 值
+        :return: 记录 ID
+        """
+        try:
+            request = models.CreateRecordRequest()
+            request.Domain = domain_name
+            request.SubDomain = sub_domain
+            request.RecordType = record_type
+            request.RecordLine = DEFAULT_RECORD_LINE
+            request.Value = value
+            request.TTL = ttl
+            response = self.client.CreateRecord(request)
+
+            if response.RecordId is not None:
+                logger.info(f"成功添加 DNS 记录: {sub_domain}.{domain_name} -> {value}")
+                return response.RecordId
+            else:
+                raise Exception("添加记录失败，未返回记录 ID")
+        except Exception as e:
+            logger.error(f"添加域名记录失败: {e}")
+            raise
+
+    def delete_domain_record(self, domain_name: str, record_id: int) -> bool:
+        """
+        删除域名记录
+
+        :param domain_name: 主域名
+        :param record_id: 记录 ID
+        :return: 是否成功
+        """
+        try:
+            request = models.DeleteRecordRequest()
+            request.Domain = domain_name
+            request.RecordId = record_id
+            self.client.DeleteRecord(request)
+
+            logger.info(f"成功删除 DNS 记录: {record_id}")
+            return True
+        except Exception as e:
+            logger.error(f"删除域名记录失败: {e}")
+            raise
+
+    @staticmethod
+    def get_root_domain(domain: str) -> str:
+        """
+        获取根域名
+
+        :param domain: 完整域名
+        :return: 根域名
+        """
+        # 简单的根域名提取逻辑，取最后两段
+        parts = domain.split(".")
+        if len(parts) >= 2:
+            return ".".join(parts[-2:])
+        return domain

certbot_dns_tencent-0.1.0/certbot_dns_tencent.egg-info/PKG-INFO

@@ -0,0 +1,104 @@
+Metadata-Version: 2.4
+Name: certbot-dns-tencent
+Version: 0.1.0
+Summary: 腾讯云 DNSPod 插件，用于 Certbot 的 DNS-01 验证
+Author-email: tiyee <tiyee@live.com>
+License: MIT
+Project-URL: Homepage, https://github.com/iDigimon/certbot-dns-tencent
+Project-URL: Repository, https://github.com/iDigimon/certbot-dns-tencent
+Project-URL: Issues, https://github.com/iDigimon/certbot-dns-tencent/issues
+Project-URL: Documentation, https://github.com/iDigimon/certbot-dns-tencent/blob/main/README.md
+Keywords: certbot-dns,certbot-plugin,certbot-dns-plugin,certbot-dns-authenticator,certbot-tencent,dnspod
+Classifier: Development Status :: 4 - Beta
+Classifier: Environment :: Plugins
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Intended Audience :: System Administrators
+Classifier: Operating System :: POSIX
+Classifier: Operating System :: POSIX :: Linux
+Classifier: Programming Language :: Python
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.8
+Classifier: Programming Language :: Python :: 3.9
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Internet :: WWW/HTTP
+Classifier: Topic :: Security
+Classifier: Topic :: System :: Installation/Setup
+Classifier: Topic :: System :: Networking
+Classifier: Topic :: System :: Systems Administration
+Classifier: Topic :: Utilities
+Requires-Python: >=3.8
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: certbot>=3.0.0
+Requires-Dist: zope
+Requires-Dist: tencentcloud-sdk-python-dnspod>=3.1.0
+Dynamic: license-file
+
+# Certbot DNS 腾讯云插件
+
+这是一个用于 Certbot 的腾讯云 DNSPod 插件，支持通过腾讯云 DNSPod API 进行 DNS-01 验证来获取 SSL 证书。支持泛域名。
+
+## 功能特性
+
+- 支持通过腾讯云 DNSPod API 自动管理 DNS 记录
+- 支持泛域名
+- 支持 certbot 3 版本（更低版本未测试）
+- 兼容 Python 3.8+ 版本
+- 支持 DNS-01 验证方式
+- 自动清理临时 DNS 记录
+- 完善的错误处理和日志记录
+
+## 安装
+
+### 从 PyPI 安装
+
+```bash
+pip3 install certbot-dns-tencent
+```
+
+## 配置文件
+
+```ini
+dns_tencent_secret_id = ??
+dns_tencent_secret_key = ??
+```
+
+修改配置文件权限（假如文件是 `~/tencent.ini`）：
+
+```bash
+chmod 600 ~/tencent.ini
+```
+
+## 运行
+
+```bash
+certbot certonly \
+  --authenticator dns-tencent \
+  --dns-tencent-credentials ~/tencent.ini \
+  --dns-tencent-propagation-seconds 30 \
+  -d "*.example.com" \
+  -d "example.com"
+```
+
+## 腾讯云权限配置
+
+确保您的腾讯云 API 密钥（SecretId / SecretKey）具有 DNSPod 的管理权限：
+
+`QcloudDNSPodFullAccess`，或自定义策略包含以下操作：
+
+- `dnspod:CreateRecord`
+- `dnspod:DeleteRecord`
+- `dnspod:DescribeRecordList`
+
+## 单元测试
+
+```bash
+python -m unittest discover -s tests -p "test_*.py" -v
+```
+
+## 自动部署
+
+此程序只是 certbot 的 DNS 验证插件，如果需要自动运行申请部署，可以使用 [AutoCert](https://github.com/tiyee/AutoCert)。

certbot_dns_tencent-0.1.0/certbot_dns_tencent.egg-info/SOURCES.txt

@@ -0,0 +1,13 @@
+LICENSE
+README.md
+pyproject.toml
+certbot_dns_tencent/__init__.py
+certbot_dns_tencent/dns_tencent.py
+certbot_dns_tencent/tencent_client.py
+certbot_dns_tencent.egg-info/PKG-INFO
+certbot_dns_tencent.egg-info/SOURCES.txt
+certbot_dns_tencent.egg-info/dependency_links.txt
+certbot_dns_tencent.egg-info/entry_points.txt
+certbot_dns_tencent.egg-info/requires.txt
+certbot_dns_tencent.egg-info/top_level.txt
+tests/test_tencent_dns.py

certbot_dns_tencent-0.1.0/certbot_dns_tencent.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

certbot_dns_tencent-0.1.0/certbot_dns_tencent.egg-info/entry_points.txt

@@ -0,0 +1,2 @@
+[certbot.plugins]
+dns-tencent = certbot_dns_tencent.dns_tencent:Authenticator

certbot_dns_tencent-0.1.0/certbot_dns_tencent.egg-info/requires.txt

@@ -0,0 +1,3 @@
+certbot>=3.0.0
+zope
+tencentcloud-sdk-python-dnspod>=3.1.0

certbot_dns_tencent-0.1.0/certbot_dns_tencent.egg-info/top_level.txt

@@ -0,0 +1 @@
+certbot_dns_tencent

certbot_dns_tencent-0.1.0/pyproject.toml

@@ -0,0 +1,65 @@
+[build-system]
+requires = ["setuptools>=64.0", "wheel"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "certbot-dns-tencent"
+version = "0.1.0"
+description = "腾讯云 DNSPod 插件，用于 Certbot 的 DNS-01 验证"
+readme = {file = "README.md", content-type = "text/markdown"}
+requires-python = ">=3.8"
+license = {text = "MIT"}
+authors = [
+    {name = "tiyee", email = "tiyee@live.com"}
+]
+keywords = [
+    "certbot-dns",
+    "certbot-plugin",
+    "certbot-dns-plugin",
+    "certbot-dns-authenticator",
+    "certbot-tencent",
+    "dnspod"
+]
+classifiers = [
+    "Development Status :: 4 - Beta",
+    "Environment :: Plugins",
+    "License :: OSI Approved :: MIT License",
+    "Intended Audience :: System Administrators",
+    "Operating System :: POSIX",
+    "Operating System :: POSIX :: Linux",
+    "Programming Language :: Python",
+    "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3.8",
+    "Programming Language :: Python :: 3.9",
+    "Programming Language :: Python :: 3.10",
+    "Programming Language :: Python :: 3.11",
+    "Programming Language :: Python :: 3.12",
+    "Programming Language :: Python :: 3.13",
+    "Topic :: Internet :: WWW/HTTP",
+    "Topic :: Security",
+    "Topic :: System :: Installation/Setup",
+    "Topic :: System :: Networking",
+    "Topic :: System :: Systems Administration",
+    "Topic :: Utilities"
+]
+dependencies = [
+    "certbot>=3.0.0",
+    "zope",
+    "tencentcloud-sdk-python-dnspod>=3.1.0"
+]
+
+[project.urls]
+Homepage = "https://github.com/iDigimon/certbot-dns-tencent"
+Repository = "https://github.com/iDigimon/certbot-dns-tencent"
+Issues = "https://github.com/iDigimon/certbot-dns-tencent/issues"
+Documentation = "https://github.com/iDigimon/certbot-dns-tencent/blob/main/README.md"
+
+[project.entry-points."certbot.plugins"]
+dns-tencent = "certbot_dns_tencent.dns_tencent:Authenticator"
+
+[tool.setuptools]
+include-package-data = true
+
+[tool.setuptools.packages.find]
+include = ["certbot_dns_tencent*"]
+exclude = ["tests*"]

certbot_dns_tencent-0.1.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

certbot_dns_tencent-0.1.0/tests/test_tencent_dns.py

@@ -0,0 +1,361 @@
+"""
+certbot-dns-tencent 单元测试
+
+使用 unittest + unittest.mock，mock 掉腾讯云 DNSPod SDK 客户端，
+无需真实凭证即可运行。
+"""
+
+import unittest
+from unittest import mock
+
+from certbot import errors
+from certbot.plugins import dns_common
+
+from certbot_dns_tencent import tencent_client
+from certbot_dns_tencent.dns_tencent import (
+    Authenticator,
+    _TencentCloudDNSHelper,
+    _get_rr_from_record_name,
+)
+from certbot_dns_tencent.tencent_client import (
+    DEFAULT_RECORD_LINE,
+    TencentCloudDNSClient,
+)
+
+
+def make_record_item(record_id, value, name, type_="TXT", ttl=600, line="默认"):
+    """构造一个模拟的 DNSPod RecordListItem"""
+    item = mock.Mock()
+    item.RecordId = record_id
+    item.Value = value
+    item.Name = name
+    item.Type = type_
+    item.TTL = ttl
+    item.Line = line
+    return item
+
+
+class TencentCloudDNSClientTest(unittest.TestCase):
+    """客户端层测试：TencentCloudDNSClient"""
+
+    def _patched_client(self):
+        """返回一个内部 SDK 客户端被 mock 的 TencentCloudDNSClient"""
+        with mock.patch.object(tencent_client.dnspod_client, "DnspodClient") as m:
+            client = TencentCloudDNSClient("sid", "skey")
+        return client, m
+
+    def test_create_client_uses_credentials_and_endpoint(self):
+        """_create_client 应使用传入的凭证与 dnspod endpoint 创建客户端"""
+        with mock.patch.object(tencent_client.dnspod_client, "DnspodClient") as mock_ctor:
+            TencentCloudDNSClient("my-id", "my-key")
+
+        # DnspodClient(cred, "", profile) 被调用一次
+        self.assertEqual(mock_ctor.call_count, 1)
+        args, _ = mock_ctor.call_args
+        cred = args[0]
+        # region 传空字符串
+        self.assertEqual(args[1], "")
+        # 凭证内容正确
+        self.assertEqual(cred.secret_id, "my-id")
+        self.assertEqual(cred.secret_key, "my-key")
+
+    def test_get_domain_records_parses_list(self):
+        """get_domain_records 应正确解析 RecordList 为 dict 列表"""
+        client, _ = self._patched_client()
+        response = mock.Mock()
+        response.RecordList = [
+            make_record_item(101, "val1", "www"),
+            make_record_item(102, "val2", "_acme-challenge", ttl=300),
+        ]
+        client.client.DescribeRecordList = mock.Mock(return_value=response)
+
+        result = client.get_domain_records("example.com", "www", "TXT")
+
+        self.assertEqual(len(result), 2)
+        self.assertEqual(result[0], {
+            "record_id": 101,
+            "sub_domain": "www",
+            "type": "TXT",
+            "value": "val1",
+            "ttl": 600,
+            "line": "默认",
+        })
+        self.assertEqual(result[1]["record_id"], 102)
+        self.assertEqual(result[1]["ttl"], 300)
+
+        # 校验请求参数：类型、主机记录、ErrorOnEmpty
+        req = client.client.DescribeRecordList.call_args.args[0]
+        self.assertEqual(req.Domain, "example.com")
+        self.assertEqual(req.SubDomain, "www")
+        self.assertEqual(req.RecordType, "TXT")
+        self.assertEqual(req.ErrorOnEmpty, "no")
+
+    def test_get_domain_records_empty(self):
+        """RecordList 为 None 时应返回空列表"""
+        client, _ = self._patched_client()
+        response = mock.Mock()
+        response.RecordList = None
+        client.client.DescribeRecordList = mock.Mock(return_value=response)
+
+        self.assertEqual(client.get_domain_records("example.com", "www"), [])
+
+    def test_get_domain_records_propagates_error(self):
+        """SDK 抛异常时应向上抛出"""
+        client, _ = self._patched_client()
+        client.client.DescribeRecordList = mock.Mock(side_effect=RuntimeError("boom"))
+
+        with self.assertRaises(RuntimeError):
+            client.get_domain_records("example.com", "www")
+
+    def test_add_domain_record_returns_id(self):
+        """add_domain_record 应返回 RecordId"""
+        client, _ = self._patched_client()
+        response = mock.Mock()
+        response.RecordId = 999
+        client.client.CreateRecord = mock.Mock(return_value=response)
+
+        record_id = client.add_domain_record("example.com", "www", "TXT", "val", 600)
+
+        self.assertEqual(record_id, 999)
+        req = client.client.CreateRecord.call_args.args[0]
+        self.assertEqual(req.Domain, "example.com")
+        self.assertEqual(req.SubDomain, "www")
+        self.assertEqual(req.RecordType, "TXT")
+        self.assertEqual(req.Value, "val")
+        self.assertEqual(req.TTL, 600)
+        # 默认线路
+        self.assertEqual(req.RecordLine, DEFAULT_RECORD_LINE)
+
+    def test_add_domain_record_no_id_raises(self):
+        """CreateRecord 未返回 RecordId 时应抛异常"""
+        client, _ = self._patched_client()
+        response = mock.Mock()
+        response.RecordId = None
+        client.client.CreateRecord = mock.Mock(return_value=response)
+
+        with self.assertRaises(Exception):
+            client.add_domain_record("example.com", "www", "TXT", "val")
+
+    def test_delete_domain_record_success(self):
+        """delete_domain_record 成功应返回 True 并传 Domain/RecordId"""
+        client, _ = self._patched_client()
+        client.client.DeleteRecord = mock.Mock()
+
+        self.assertTrue(client.delete_domain_record("example.com", 999))
+        req = client.client.DeleteRecord.call_args.args[0]
+        self.assertEqual(req.Domain, "example.com")
+        self.assertEqual(req.RecordId, 999)
+
+    def test_get_root_domain(self):
+        """根域名提取：取最后两段"""
+        self.assertEqual(TencentCloudDNSClient.get_root_domain("a.b.example.com"), "example.com")
+        self.assertEqual(TencentCloudDNSClient.get_root_domain("example.com"), "example.com")
+        self.assertEqual(TencentCloudDNSClient.get_root_domain("localhost"), "localhost")
+
+
+class HelperTest(unittest.TestCase):
+    """辅助层测试：_TencentCloudDNSHelper"""
+
+    def _helper(self):
+        """返回一个内部 client 被 mock 的 helper"""
+        with mock.patch.object(tencent_client.dnspod_client, "DnspodClient"):
+            helper = _TencentCloudDNSHelper("sid", "skey", 600)
+        helper.client = mock.Mock(spec=TencentCloudDNSClient)
+        return helper
+
+    def test_add_txt_record_new(self):
+        """无现存记录时应调用 add_domain_record 并存 id"""
+        helper = self._helper()
+        helper.client.get_domain_records = mock.Mock(return_value=[])
+        helper.client.add_domain_record = mock.Mock(return_value=555)
+
+        with mock.patch("certbot_dns_tencent.dns_tencent.time.sleep"):
+            helper.add_txt_record("_acme-challenge.www.example.com", "token-value")
+
+        helper.client.add_domain_record.assert_called_once_with(
+            "example.com", "_acme-challenge.www", "TXT", "token-value", 600
+        )
+        # 记录 id 已缓存
+        self.assertEqual(
+            helper._record_ids["_acme-challenge.www.example.com"], 555
+        )
+
+    def test_add_txt_record_already_exists(self):
+        """已存在相同值的记录时应跳过（幂等，不重复添加）"""
+        helper = self._helper()
+        helper.client.get_domain_records = mock.Mock(
+            return_value=[{"record_id": 77, "value": "token-value"}]
+        )
+        helper.client.add_domain_record = mock.Mock()
+
+        with mock.patch("certbot_dns_tencent.dns_tencent.time.sleep"):
+            helper.add_txt_record("_acme-challenge.example.com", "token-value")
+
+        # 不应调用添加
+        helper.client.add_domain_record.assert_not_called()
+        # 复用已有记录的 id
+        self.assertEqual(
+            helper._record_ids["_acme-challenge.example.com"], 77
+        )
+
+    def test_add_txt_record_raises_plugin_error(self):
+        """底层异常应转为 certbot PluginError"""
+        helper = self._helper()
+        helper.client.get_domain_records = mock.Mock(
+            side_effect=RuntimeError("api down")
+        )
+
+        with self.assertRaises(errors.PluginError):
+            helper.add_txt_record("_acme-challenge.example.com", "token-value")
+
+    def test_del_txt_record_with_cached_id(self):
+        """有已存 id 时应优先用 id 删除"""
+        helper = self._helper()
+        helper._record_ids["_acme-challenge.example.com"] = 42
+        helper.client.delete_domain_record = mock.Mock()
+
+        helper.del_txt_record("_acme-challenge.example.com", "token-value")
+
+        helper.client.delete_domain_record.assert_called_once_with("example.com", 42)
+        # 缓存被清理
+        self.assertNotIn("_acme-challenge.example.com", helper._record_ids)
+
+    def test_del_txt_record_fallback_query(self):
+        """无已存 id 时应回退查询并删除匹配项"""
+        helper = self._helper()
+        helper.client.get_domain_records = mock.Mock(
+            return_value=[
+                {"record_id": 1, "value": "other"},
+                {"record_id": 2, "value": "token-value"},
+            ]
+        )
+        helper.client.delete_domain_record = mock.Mock()
+
+        helper.del_txt_record("_acme-challenge.example.com", "token-value")
+
+        # 只删除 value 匹配的那条
+        helper.client.delete_domain_record.assert_called_once_with("example.com", 2)
+
+    def test_del_txt_record_not_found_no_raise(self):
+        """查无记录时不应抛异常（清理失败不影响出证）"""
+        helper = self._helper()
+        helper.client.get_domain_records = mock.Mock(return_value=[])
+        helper.client.delete_domain_record = mock.Mock()
+
+        # 不应抛出
+        helper.del_txt_record("_acme-challenge.example.com", "token-value")
+        helper.client.delete_domain_record.assert_not_called()
+
+    def test_del_txt_record_swallows_error(self):
+        """清理时底层抛异常应被吞掉（不影响证书获取）"""
+        helper = self._helper()
+        helper.client.get_domain_records = mock.Mock(
+            side_effect=RuntimeError("api down")
+        )
+
+        # 不应抛出
+        helper.del_txt_record("_acme-challenge.example.com", "token-value")
+
+    def test_get_domain_from_record_name(self):
+        """应正确去掉 _acme-challenge. 前缀并取根域"""
+        self.assertEqual(
+            _TencentCloudDNSHelper._get_domain_from_record_name(
+                "_acme-challenge.www.example.com"
+            ),
+            "example.com",
+        )
+        self.assertEqual(
+            _TencentCloudDNSHelper._get_domain_from_record_name("example.com"),
+            "example.com",
+        )
+
+
+class AuthenticatorTest(unittest.TestCase):
+    """认证器层测试：Authenticator"""
+
+    def test_more_info(self):
+        """more_info 返回非空字符串"""
+        self.assertIsInstance(Authenticator.more_info(None), str)
+        self.assertTrue(len(Authenticator.more_info(None)) > 0)
+
+    def test_add_parser_arguments(self):
+        """add_parser_arguments 应注册 credentials 参数"""
+        add = mock.Mock()
+        Authenticator.add_parser_arguments(add)
+        # 至少调用了注册 credentials
+        calls = [c.args[0] for c in add.call_args_list if c.args]
+        self.assertIn("credentials", calls)
+
+    def test_get_tencent_client_without_credentials(self):
+        """凭证未配置时 _get_tencent_client 应抛 errors.Error"""
+        authenticator = Authenticator.__new__(Authenticator)
+        authenticator.credentials = None
+        authenticator.ttl = 600
+        with self.assertRaises(errors.Error):
+            authenticator._get_tencent_client()
+
+    def test_get_tencent_client_with_credentials(self):
+        """配置了凭证时应返回 helper（client 被 mock）"""
+        authenticator = Authenticator.__new__(Authenticator)
+        creds = mock.Mock()
+        creds.conf = lambda key: {"secret_id": "sid", "secret_key": "skey"}.get(key)
+        authenticator.credentials = creds
+        authenticator.ttl = 600
+
+        with mock.patch.object(tencent_client.dnspod_client, "DnspodClient"):
+            helper = authenticator._get_tencent_client()
+        self.assertIsInstance(helper, _TencentCloudDNSHelper)
+
+    def test_perform_delegates_to_helper(self):
+        """_perform 应委托给 helper.add_txt_record"""
+        authenticator = Authenticator.__new__(Authenticator)
+        authenticator.ttl = 600
+        authenticator.credentials = mock.Mock()
+
+        with mock.patch.object(Authenticator, "_get_tencent_client") as m:
+            helper = m.return_value
+            authenticator._perform(
+                "example.com", "_acme-challenge.example.com", "token-value"
+            )
+        helper.add_txt_record.assert_called_once_with(
+            "_acme-challenge.example.com", "token-value"
+        )
+
+    def test_cleanup_delegates_to_helper(self):
+        """_cleanup 应委托给 helper.del_txt_record"""
+        authenticator = Authenticator.__new__(Authenticator)
+        authenticator.ttl = 600
+        authenticator.credentials = mock.Mock()
+
+        with mock.patch.object(Authenticator, "_get_tencent_client") as m:
+            helper = m.return_value
+            authenticator._cleanup(
+                "example.com", "_acme-challenge.example.com", "token-value"
+            )
+        helper.del_txt_record.assert_called_once_with(
+            "_acme-challenge.example.com", "token-value"
+        )
+
+
+class UtilTest(unittest.TestCase):
+    """工具函数测试"""
+
+    def test_get_rr_from_record_name(self):
+        """主机记录提取"""
+        self.assertEqual(
+            _get_rr_from_record_name("_acme-challenge.www.example.com", "example.com"),
+            "_acme-challenge.www",
+        )
+        self.assertEqual(
+            _get_rr_from_record_name("www.example.com", "example.com"),
+            "www",
+        )
+        # 不以 .domain 结尾时原样返回
+        self.assertEqual(
+            _get_rr_from_record_name("example.com", "example.com"),
+            "example.com",
+        )
+
+
+if __name__ == "__main__":
+    unittest.main()