first build

tests/test_enrollment.py

@@ -0,0 +1,33 @@
+from cryptography import x509
+from cryptography.x509 import load_pem_x509_csr
+
+from cert_portal.enrollment import (
+    SID_SAN_URI_PREFIX,
+    UPN_OID,
+    build_csr,
+    generate_rsa_key,
+    sid_san_uri,
+)
+
+
+def test_csr_contains_upn_othername_and_sid_uri():
+    key = generate_rsa_key(2048).key
+    upn = "[email protected]"
+    sid = "S-1-5-21-1-2-3-4"
+    pem = build_csr(key=key, upn=upn, sid=sid)
+    csr = load_pem_x509_csr(pem)
+    assert csr.subject.rfc4514_string() == f"CN={upn}"
+    san = csr.extensions.get_extension_for_class(x509.SubjectAlternativeName).value
+    names = list(san)
+    uris = [n.value for n in names if isinstance(n, x509.UniformResourceIdentifier)]
+    others = [n for n in names if isinstance(n, x509.OtherName)]
+    assert uris == [f"{SID_SAN_URI_PREFIX}{sid}"]
+    assert sid_san_uri(sid) in uris
+    assert any(o.type_id == UPN_OID for o in others)
+    upn_other = next(o for o in others if o.type_id == UPN_OID)
+    # DER UTF8String: tag 0x0c, short length, payload
+    assert upn_other.value[0] == 0x0C
+    length = upn_other.value[1]
+    assert upn_other.value[2 : 2 + length].decode("utf-8") == upn
+    assert b"-----BEGIN CERTIFICATE REQUEST-----" in pem
+    assert pem.startswith(b"-----BEGIN")