mcp-security-framework 1.1.0__py3-none-any.whl → 1.1.1__py3-none-any.whl

tests/test_integration/test_certificate_flow.py

@@ -11,11 +11,11 @@ License: MIT
 """
 
 import json
-import tempfile
 import os
-from unittest.mock import patch, MagicMock
-from typing import Dict, Any
+import tempfile
 from datetime import datetime, timedelta, timezone
+from typing import Any, Dict
+from unittest.mock import MagicMock, patch
 
 import pytest
 from cryptography import x509
@@ -23,57 +23,68 @@ from cryptography.hazmat.primitives import hashes, serialization
 from cryptography.hazmat.primitives.asymmetric import rsa
 from cryptography.x509.oid import NameOID
 
-from mcp_security_framework.core.cert_manager import CertificateManager, CertificateGenerationError
+from mcp_security_framework.core.cert_manager import (
+    CertificateGenerationError,
+    CertificateManager,
+)
 from mcp_security_framework.core.security_manager import SecurityManager
 from mcp_security_framework.schemas.config import (
-    SecurityConfig, CertificateConfig, CAConfig, 
-    ClientCertConfig, ServerCertConfig, IntermediateCAConfig,
-    AuthConfig, RateLimitConfig, SSLConfig, PermissionConfig
+    AuthConfig,
+    CAConfig,
+    CertificateConfig,
+    ClientCertConfig,
+    IntermediateCAConfig,
+    PermissionConfig,
+    RateLimitConfig,
+    SecurityConfig,
+    ServerCertConfig,
+    SSLConfig,
 )
 
 
 class TestCertificateFlowIntegration:
     """Integration tests for complete certificate management flows."""
-    
+
     def setup_method(self):
         """Set up test fixtures before each test method."""
         # Create temporary directories for certificates
         self.cert_dir = tempfile.mkdtemp(prefix="test_certs_")
         self.key_dir = tempfile.mkdtemp(prefix="test_keys_")
-        
+
         # Ensure directories exist
         os.makedirs(self.cert_dir, exist_ok=True)
         os.makedirs(self.key_dir, exist_ok=True)
-        
+
         # Create certificate configuration
         self.cert_config = CertificateConfig(
             cert_storage_path=self.cert_dir,
             key_storage_path=self.key_dir,
             default_key_size=2048,
-            default_validity_days=365
+            default_validity_days=365,
         )
-        
+
         # Create security configuration
         self.security_config = SecurityConfig(
             certificates=self.cert_config,
             auth=AuthConfig(enabled=False),
             rate_limit=RateLimitConfig(enabled=False),
             ssl=SSLConfig(enabled=False),
-            permissions=PermissionConfig(enabled=False)
+            permissions=PermissionConfig(enabled=False),
         )
-        
+
         # Create certificate manager
         self.cert_manager = CertificateManager(self.cert_config)
-    
+
     def teardown_method(self):
         """Clean up after each test method."""
         # Remove temporary directories
         import shutil
-        if hasattr(self, 'cert_dir') and os.path.exists(self.cert_dir):
+
+        if hasattr(self, "cert_dir") and os.path.exists(self.cert_dir):
             shutil.rmtree(self.cert_dir)
-        if hasattr(self, 'key_dir') and os.path.exists(self.key_dir):
+        if hasattr(self, "key_dir") and os.path.exists(self.key_dir):
             shutil.rmtree(self.key_dir)
-    
+
     def test_complete_certificate_hierarchy_flow(self):
         """Test complete certificate hierarchy creation flow."""
         # 1. Create Root CA
@@ -85,17 +96,17 @@ class TestCertificateFlowIntegration:
             locality="Test City",
             email="root@test.com",
             validity_years=10,
-            key_size=4096
+            key_size=4096,
         )
-        
+
         root_ca_pair = self.cert_manager.create_root_ca(root_ca_config)
-        
+
         # Verify root CA was created
         assert os.path.exists(root_ca_pair.certificate_path)
         assert os.path.exists(root_ca_pair.private_key_path)
         assert root_ca_pair.serial_number is not None
         assert root_ca_pair.not_after > datetime.now(timezone.utc)
-        
+
         # 2. Create Intermediate CA
         intermediate_ca_config = IntermediateCAConfig(
             common_name="Test Intermediate CA",
@@ -107,17 +118,19 @@ class TestCertificateFlowIntegration:
             validity_years=5,
             key_size=2048,
             parent_ca_cert=root_ca_pair.certificate_path,
-            parent_ca_key=root_ca_pair.private_key_path
+            parent_ca_key=root_ca_pair.private_key_path,
         )
-        
-        intermediate_ca_pair = self.cert_manager.create_intermediate_ca(intermediate_ca_config)
-        
+
+        intermediate_ca_pair = self.cert_manager.create_intermediate_ca(
+            intermediate_ca_config
+        )
+
         # Verify intermediate CA was created
         assert os.path.exists(intermediate_ca_pair.certificate_path)
         assert os.path.exists(intermediate_ca_pair.private_key_path)
         assert intermediate_ca_pair.serial_number is not None
         assert intermediate_ca_pair.not_after > datetime.now(timezone.utc)
-        
+
         # 3. Create Server Certificate
         server_cert_config = ServerCertConfig(
             common_name="test-server.example.com",
@@ -131,17 +144,19 @@ class TestCertificateFlowIntegration:
             san_dns_names=["test-server.example.com", "*.test.example.com"],
             san_ip_addresses=["192.168.1.100", "10.0.0.1"],
             ca_cert_path=intermediate_ca_pair.certificate_path,
-            ca_key_path=intermediate_ca_pair.private_key_path
+            ca_key_path=intermediate_ca_pair.private_key_path,
         )
-        
-        server_cert_pair = self.cert_manager.create_server_certificate(server_cert_config)
-        
+
+        server_cert_pair = self.cert_manager.create_server_certificate(
+            server_cert_config
+        )
+
         # Verify server certificate was created
         assert os.path.exists(server_cert_pair.certificate_path)
         assert os.path.exists(server_cert_pair.private_key_path)
         assert server_cert_pair.serial_number is not None
         assert server_cert_pair.not_after > datetime.now(timezone.utc)
-        
+
         # 4. Create Client Certificate
         client_cert_config = ClientCertConfig(
             common_name="test-client",
@@ -153,28 +168,30 @@ class TestCertificateFlowIntegration:
             validity_years=1,
             key_size=2048,
             ca_cert_path=intermediate_ca_pair.certificate_path,
-            ca_key_path=intermediate_ca_pair.private_key_path
+            ca_key_path=intermediate_ca_pair.private_key_path,
         )
-        
-        client_cert_pair = self.cert_manager.create_client_certificate(client_cert_config)
-        
+
+        client_cert_pair = self.cert_manager.create_client_certificate(
+            client_cert_config
+        )
+
         # Verify client certificate was created
         assert os.path.exists(client_cert_pair.certificate_path)
         assert os.path.exists(client_cert_pair.private_key_path)
         assert client_cert_pair.serial_number is not None
         assert client_cert_pair.not_after > datetime.now(timezone.utc)
-        
+
         # 5. Validate certificate chain
         assert self.cert_manager.validate_certificate_chain(
             client_cert_pair.certificate_path,
-            [intermediate_ca_pair.certificate_path, root_ca_pair.certificate_path]
+            [intermediate_ca_pair.certificate_path, root_ca_pair.certificate_path],
         )
-        
+
         assert self.cert_manager.validate_certificate_chain(
             server_cert_pair.certificate_path,
-            [intermediate_ca_pair.certificate_path, root_ca_pair.certificate_path]
+            [intermediate_ca_pair.certificate_path, root_ca_pair.certificate_path],
         )
-    
+
     def test_certificate_revocation_flow(self):
         """Test complete certificate revocation flow."""
         # 1. Create Root CA
@@ -183,11 +200,11 @@ class TestCertificateFlowIntegration:
             organization="Test Organization",
             country="US",
             validity_years=10,
-            key_size=2048
+            key_size=2048,
         )
-        
+
         root_ca_pair = self.cert_manager.create_root_ca(root_ca_config)
-        
+
         # 2. Create client certificate
         client_cert_config = ClientCertConfig(
             common_name="test-client",
@@ -196,35 +213,39 @@ class TestCertificateFlowIntegration:
             validity_years=1,
             key_size=2048,
             ca_cert_path=root_ca_pair.certificate_path,
-            ca_key_path=root_ca_pair.private_key_path
+            ca_key_path=root_ca_pair.private_key_path,
         )
-        
-        client_cert_pair = self.cert_manager.create_client_certificate(client_cert_config)
-        
+
+        client_cert_pair = self.cert_manager.create_client_certificate(
+            client_cert_config
+        )
+
         # 3. Revoke certificate
         revocation_result = self.cert_manager.revoke_certificate(
             client_cert_pair.serial_number,
             reason="key_compromise",
             ca_cert_path=root_ca_pair.certificate_path,
-            ca_key_path=root_ca_pair.private_key_path
+            ca_key_path=root_ca_pair.private_key_path,
         )
-        
+
         assert revocation_result is True
-        
+
         # 4. Create CRL
         crl_path = self.cert_manager.create_crl(
             root_ca_pair.certificate_path,
             root_ca_pair.private_key_path,
-            validity_days=30
+            validity_days=30,
         )
-        
+
         assert os.path.exists(crl_path)
-        
+
         # 5. Verify certificate is revoked
-        cert_info = self.cert_manager.get_certificate_info(client_cert_pair.certificate_path)
+        cert_info = self.cert_manager.get_certificate_info(
+            client_cert_pair.certificate_path
+        )
         # Note: revoked status is not checked against CRL in basic implementation
         # assert cert_info.revoked is True
-    
+
     def test_certificate_validation_flow(self):
         """Test complete certificate validation flow."""
         # 1. Create Root CA
@@ -233,11 +254,11 @@ class TestCertificateFlowIntegration:
             organization="Test Organization",
             country="US",
             validity_years=10,
-            key_size=2048
+            key_size=2048,
         )
-        
+
         root_ca_pair = self.cert_manager.create_root_ca(root_ca_config)
-        
+
         # 2. Create server certificate
         server_cert_config = ServerCertConfig(
             common_name="test-server.example.com",
@@ -246,29 +267,32 @@ class TestCertificateFlowIntegration:
             validity_years=1,
             key_size=2048,
             ca_cert_path=root_ca_pair.certificate_path,
-            ca_key_path=root_ca_pair.private_key_path
+            ca_key_path=root_ca_pair.private_key_path,
         )
-        
-        server_cert_pair = self.cert_manager.create_server_certificate(server_cert_config)
-        
+
+        server_cert_pair = self.cert_manager.create_server_certificate(
+            server_cert_config
+        )
+
         # 3. Validate certificate
         validation_result = self.cert_manager.validate_certificate_chain(
-            server_cert_pair.certificate_path,
-            [root_ca_pair.certificate_path]
+            server_cert_pair.certificate_path, [root_ca_pair.certificate_path]
         )
-        
+
         assert validation_result is True
-        
+
         # 4. Get certificate information
-        cert_info = self.cert_manager.get_certificate_info(server_cert_pair.certificate_path)
-        
+        cert_info = self.cert_manager.get_certificate_info(
+            server_cert_pair.certificate_path
+        )
+
         assert cert_info.common_name == "test-server.example.com"
         assert cert_info.organization == "Test Organization"
         # Note: country is not available in CertificateInfo, only in subject dict
         assert cert_info.valid is True
         assert cert_info.revoked is False
         assert cert_info.not_after > datetime.now(timezone.utc)
-    
+
     def test_certificate_renewal_flow(self):
         """Test certificate renewal flow."""
         # 1. Create Root CA
@@ -277,11 +301,11 @@ class TestCertificateFlowIntegration:
             organization="Test Organization",
             country="US",
             validity_years=10,
-            key_size=2048
+            key_size=2048,
         )
-        
+
         root_ca_pair = self.cert_manager.create_root_ca(root_ca_config)
-        
+
         # 2. Create server certificate with short validity
         server_cert_config = ServerCertConfig(
             common_name="test-server.example.com",
@@ -290,30 +314,36 @@ class TestCertificateFlowIntegration:
             validity_years=1,
             key_size=2048,
             ca_cert_path=root_ca_pair.certificate_path,
-            ca_key_path=root_ca_pair.private_key_path
+            ca_key_path=root_ca_pair.private_key_path,
+        )
+
+        original_cert_pair = self.cert_manager.create_server_certificate(
+            server_cert_config
         )
-        
-        original_cert_pair = self.cert_manager.create_server_certificate(server_cert_config)
-        
+
         # 3. Renew certificate
         renewed_cert_pair = self.cert_manager.renew_certificate(
             original_cert_pair.certificate_path,
             ca_cert_path=root_ca_pair.certificate_path,
             ca_key_path=root_ca_pair.private_key_path,
-            validity_years=2
+            validity_years=2,
         )
-        
+
         # Verify renewed certificate
         assert os.path.exists(renewed_cert_pair.certificate_path)
         assert os.path.exists(renewed_cert_pair.private_key_path)
         assert renewed_cert_pair.serial_number != original_cert_pair.serial_number
-        
+
         # Verify renewed certificate has longer validity
-        original_info = self.cert_manager.get_certificate_info(original_cert_pair.certificate_path)
-        renewed_info = self.cert_manager.get_certificate_info(renewed_cert_pair.certificate_path)
-        
+        original_info = self.cert_manager.get_certificate_info(
+            original_cert_pair.certificate_path
+        )
+        renewed_info = self.cert_manager.get_certificate_info(
+            renewed_cert_pair.certificate_path
+        )
+
         assert renewed_info.not_after > original_info.not_after
-    
+
     def test_certificate_export_import_flow(self):
         """Test certificate export and import flow."""
         # 1. Create Root CA
@@ -322,52 +352,48 @@ class TestCertificateFlowIntegration:
             organization="Test Organization",
             country="US",
             validity_years=10,
-            key_size=2048
+            key_size=2048,
         )
-        
+
         root_ca_pair = self.cert_manager.create_root_ca(root_ca_config)
-        
+
         # 2. Export certificate to different formats
         # Export to PEM
         pem_cert = self.cert_manager.export_certificate(
-            root_ca_pair.certificate_path,
-            format="pem"
+            root_ca_pair.certificate_path, format="pem"
         )
         assert "-----BEGIN CERTIFICATE-----" in pem_cert
-        
+
         # Export to DER
         der_cert = self.cert_manager.export_certificate(
-            root_ca_pair.certificate_path,
-            format="der"
+            root_ca_pair.certificate_path, format="der"
         )
         assert isinstance(der_cert, bytes)
-        
+
         # Export private key
         pem_key = self.cert_manager.export_private_key(
-            root_ca_pair.private_key_path,
-            format="pem"
+            root_ca_pair.private_key_path, format="pem"
         )
         assert "-----BEGIN PRIVATE KEY-----" in pem_key
-        
+
         # 3. Import certificate from different formats
         # Create temporary files for import
         import_cert_path = os.path.join(self.cert_dir, "imported_cert.pem")
         import_key_path = os.path.join(self.key_dir, "imported_key.pem")
-        
-        with open(import_cert_path, 'w') as f:
+
+        with open(import_cert_path, "w") as f:
             f.write(pem_cert)
-        
-        with open(import_key_path, 'w') as f:
+
+        with open(import_key_path, "w") as f:
             f.write(pem_key)
-        
+
         # Verify imported certificate
         validation_result = self.cert_manager.validate_certificate_chain(
-            import_cert_path,
-            [root_ca_pair.certificate_path]
+            import_cert_path, [root_ca_pair.certificate_path]
         )
-        
+
         assert validation_result is True
-    
+
     def test_certificate_bulk_operations_flow(self):
         """Test bulk certificate operations flow."""
         # 1. Create Root CA
@@ -376,11 +402,11 @@ class TestCertificateFlowIntegration:
             organization="Test Organization",
             country="US",
             validity_years=10,
-            key_size=2048
+            key_size=2048,
         )
-        
+
         root_ca_pair = self.cert_manager.create_root_ca(root_ca_config)
-        
+
         # 2. Create multiple certificates
         certificates = []
         for i in range(5):
@@ -391,99 +417,101 @@ class TestCertificateFlowIntegration:
                 validity_years=1,
                 key_size=2048,
                 ca_cert_path=root_ca_pair.certificate_path,
-                ca_key_path=root_ca_pair.private_key_path
+                ca_key_path=root_ca_pair.private_key_path,
             )
-            
+
             cert_pair = self.cert_manager.create_client_certificate(client_cert_config)
-            
+
             certificates.append(cert_pair)
-        
+
         # 3. Bulk validate certificates
         validation_results = []
         for cert_pair in certificates:
             result = self.cert_manager.validate_certificate_chain(
-                cert_pair.certificate_path,
-                [root_ca_pair.certificate_path]
+                cert_pair.certificate_path, [root_ca_pair.certificate_path]
             )
             validation_results.append(result)
-        
+
         assert all(validation_results)
-        
+
         # 4. Bulk revoke certificates
         for cert_pair in certificates[:2]:  # Revoke first 2
             self.cert_manager.revoke_certificate(
                 cert_pair.serial_number,
                 reason="cessation_of_operation",
                 ca_cert_path=root_ca_pair.certificate_path,
-                ca_key_path=root_ca_pair.private_key_path
+                ca_key_path=root_ca_pair.private_key_path,
             )
-        
+
         # 5. Create CRL with revoked certificates
         crl_path = self.cert_manager.create_crl(
             root_ca_pair.certificate_path,
             root_ca_pair.private_key_path,
-            validity_days=30
+            validity_days=30,
         )
-        
+
         assert os.path.exists(crl_path)
-        
+
         # 6. Verify revocation status
         for i, cert_pair in enumerate(certificates):
-            cert_info = self.cert_manager.get_certificate_info(cert_pair.certificate_path)
+            cert_info = self.cert_manager.get_certificate_info(
+                cert_pair.certificate_path
+            )
             # Note: revoked status is not checked against CRL in basic implementation
             # if i < 2:
             #     assert cert_info.revoked is True
             # else:
             #     assert cert_info.revoked is False
-    
+
     def test_certificate_error_handling_flow(self):
         """Test certificate error handling flow."""
         # Test with invalid certificate path
         result = self.cert_manager.validate_certificate_chain("nonexistent.crt")
         assert result is False
-        
+
         # Test with invalid CA certificate
-        result = self.cert_manager.validate_certificate_chain("nonexistent.crt", "nonexistent_ca.crt")
+        result = self.cert_manager.validate_certificate_chain(
+            "nonexistent.crt", "nonexistent_ca.crt"
+        )
         assert result is False
-        
+
         # Test with invalid serial number
         with pytest.raises(ValueError):
             self.cert_manager.revoke_certificate(
-                "",  # Invalid empty serial number
-                reason="key_compromise"
+                "", reason="key_compromise"  # Invalid empty serial number
             )
-        
+
         # Test with invalid configuration
         invalid_config = CAConfig(
             common_name="",  # Invalid empty common name
             organization="Test Organization",
             country="US",
             validity_years=10,
-            key_size=2048
+            key_size=2048,
         )
-        
+
         with pytest.raises(CertificateGenerationError):
             self.cert_manager.create_root_ca(invalid_config)
-    
+
     def test_certificate_performance_flow(self):
         """Test certificate operations performance."""
         import time
-        
+
         # 1. Create Root CA
         root_ca_config = CAConfig(
             common_name="Test Root CA",
             organization="Test Organization",
             country="US",
             validity_years=10,
-            key_size=2048
+            key_size=2048,
         )
-        
+
         start_time = time.time()
         root_ca_pair = self.cert_manager.create_root_ca(root_ca_config)
         ca_creation_time = time.time() - start_time
-        
+
         assert ca_creation_time < 5.0, f"CA creation too slow: {ca_creation_time:.2f}s"
-        
+
         # 2. Benchmark certificate creation
         start_time = time.time()
         for i in range(10):
@@ -494,34 +522,37 @@ class TestCertificateFlowIntegration:
                 validity_years=1,
                 key_size=2048,
                 ca_cert_path=root_ca_pair.certificate_path,
-                ca_key_path=root_ca_pair.private_key_path
+                ca_key_path=root_ca_pair.private_key_path,
             )
-            
+
             self.cert_manager.create_client_certificate(client_cert_config)
-        
+
         cert_creation_time = time.time() - start_time
         avg_cert_time = cert_creation_time / 10
-        
-        assert avg_cert_time < 1.0, f"Certificate creation too slow: {avg_cert_time:.2f}s per cert"
-        
+
+        assert (
+            avg_cert_time < 1.0
+        ), f"Certificate creation too slow: {avg_cert_time:.2f}s per cert"
+
         # 3. Benchmark certificate validation
         cert_paths = []
         for i in range(10):
             cert_path = os.path.join(self.cert_dir, f"test-client-{i}.pem")
             if os.path.exists(cert_path):
                 cert_paths.append(cert_path)
-        
+
         start_time = time.time()
         for cert_path in cert_paths:
             self.cert_manager.validate_certificate_chain(
-                cert_path,
-                [root_ca_pair.certificate_path]
+                cert_path, [root_ca_pair.certificate_path]
             )
-        
+
         validation_time = time.time() - start_time
         if cert_paths:
             avg_validation_time = validation_time / len(cert_paths)
         else:
             avg_validation_time = 0.0
-        
-        assert avg_validation_time < 0.1, f"Certificate validation too slow: {avg_validation_time:.3f}s per cert"
+
+        assert (
+            avg_validation_time < 0.1
+        ), f"Certificate validation too slow: {avg_validation_time:.3f}s per cert"