RSpec.describe "certificates" do
  def get_all_cas_usages(o)
    return o.flat_map { |v| get_all_cas_usages(v) } if o.is_a? Array

    if o.is_a? Hash
      return o.values.flat_map { |v| get_all_cas_usages(v) } unless o.key? 'ca'
      # Match checks if it is a usage ("name.value") or a variable ("name")
      return [o['ca']] if o['ca'].match?(/[.]/)
    end

    []
  end

  context "ca certificates" do
    let(:manifest) { manifest_with_defaults }

    let(:ca_usages) do
      get_all_cas_usages(manifest.fetch('.')).map do |usage|
        usage.gsub(/[()]/, '') # delete surrounding parens
      end
    end

    it "should use .ca for every usage of a ca certificate" do
      ca_usages.each do |ca_usage|
        expect(ca_usage).to match(/[.]ca$/),
          "Usage of CA #{ca_usage} should be cert_name.ca not ca_name.certificate, otherwise credhub rotation will fail"
      end
    end
  end
end

RSpec.describe "certificates" do
  def get_all_cas_usages(o)
    return o.flat_map { |v| get_all_cas_usages(v) } if o.is_a? Array

    if o.is_a? Hash
      # Match checks if it is a usage ("name.value") or a variable ("name")
      return [o['ca']] if o['ca']&.match?(/[.]/)
      return [o['ca_cert']] if o['ca_cert']&.match?(/[.]/)

      return o.values.flat_map { |v| get_all_cas_usages(v) }
    end

    []
  end

  context "ca certificates" do
    let(:manifest) { manifest_with_defaults }

    let(:ca_usages) do
      get_all_cas_usages(manifest.fetch('.')).map do |usage|
        usage.gsub(/[()]/, '') # delete surrounding parens
      end
    end

    it "should detect some ca certificate usages" do
      expect(ca_usages).not_to eq([])
    end

    it "should use .ca for every usage of a ca certificate" do
      ca_usages.each do |ca_usage|
        expect(ca_usage).to match(/[.]ca$/),
          "Usage of CA #{ca_usage} should be cert_name.ca not ca_name.certificate, otherwise credhub rotation will fail"
      end
    end
  end
end

Expand CA cert test to include ca_cert property
Expand CA cert test to include ca_cert property

Some releases use ca_cert: instead of ca:

Signed-off-by: Toby Lorne <527052641d65eef236eeef9545b2acac74c35d57@digital.cabinet-office.gov.uk>
