v0,28,2

src/db/tests.rs

@@ -105,12 +105,21 @@ mod tests {
         let token = "b".repeat(64);
         let hash = crate::auth::secret_hash(&token);
         let saved = store
-            .upsert_certificate_api_credential("certbot-main", &hash, "production certbot", "owner")
+            .upsert_certificate_api_credential(
+                "certbot-main",
+                &hash,
+                "production certbot",
+                false,
+                &["shared-cert".to_owned()],
+                "owner",
+            )
             .await
             .unwrap();
         assert_eq!(saved.key_id, "certbot-main");
         assert_eq!(saved.comment, "production certbot");
         assert!(saved.last_used_at.is_none());
+        assert!(!saved.allow_deploy);
+        assert_eq!(saved.certificate_ids, vec!["shared-cert"]);
 
         let raw: String = sqlx::query_scalar(
             "SELECT token_hash FROM certificate_api_credentials WHERE key_id = ?",
@@ -128,23 +137,30 @@ mod tests {
                 "deploy-hook",
                 &second_hash,
                 "secondary deploy hook",
+                true,
+                &["deploy-cert".to_owned()],
                 "owner",
             )
             .await
             .unwrap();
         assert_eq!(store.certificate_api_credentials().await.unwrap().len(), 2);
 
-        assert!(store
+        let grant = store
             .verify_certificate_api_credential("certbot-main", &hash)
             .await
-            .unwrap());
-        assert!(!store
+            .unwrap()
+            .unwrap();
+        assert!(!grant.allow_deploy);
+        assert!(grant.allows_certificate("shared-cert"));
+        assert!(!grant.allows_certificate("other-cert"));
+        assert!(store
             .verify_certificate_api_credential(
                 "certbot-main",
                 &crate::auth::secret_hash(&"c".repeat(64)),
             )
             .await
-            .unwrap());
+            .unwrap()
+            .is_none());
         let credentials = store.certificate_api_credentials().await.unwrap();
         assert!(credentials
             .iter()