RSpec.describe "certificates" do
  def get_all_cas_usages(o)
    return o.flat_map { |v| get_all_cas_usages(v) } if o.is_a? Array

    if o.is_a? Hash
      return o.values.flat_map { |v| get_all_cas_usages(v) } unless o.key? 'ca'
      # Match checks if it is a usage ("name.value") or a variable ("name")
      return [o['ca']] if o['ca'].match?(/[.]/)
    end

    []
  end

  context "ca certificates" do
    let(:manifest) { manifest_with_defaults }

    let(:ca_usages) do
      get_all_cas_usages(manifest.fetch('.')).map do |usage|
        usage.gsub(/[()]/, '') # delete surrounding parens
      end
    end

    it "should use .ca for every usage of a ca certificate" do
      ca_usages.each do |ca_usage|
        expect(ca_usage).to match(/[.]ca$/),
          "Usage of CA #{ca_usage} should be cert_name.ca not ca_name.certificate, otherwise credhub rotation will fail"
      end
    end
  end
end

Add a test for ca usages so ca_cert rotation works
Add a test for ca usages so ca_cert rotation works

If you use ((ca.certificate)) when refering to a certificate's CA cert,
then you will only get the latest CA certificate interpolated in the
manifest

You must instead use ((certficate.ca))

When you use ((certificate.ca)) and the latest CA has the "transitional"
flag, then BOSH will put the latest ca cert (transitional) and the
latest non-transitional ca cert

This commit adds a test so that any usage of a CA should not refer to
the CA certificate directly

Signed-off-by: Toby Lorne <527052641d65eef236eeef9545b2acac74c35d57@digital.cabinet-office.gov.uk>
