1 files changed, 47 insertions, 8 deletions

diff --git a/spec/lib/gitlab/email/smime/certificate_spec.rb b/spec/lib/gitlab/email/smime/certificate_spec.rb
index 90b27602413..07b8c1e4de1 100644
--- a/spec/lib/gitlab/email/smime/certificate_spec.rb
+++ b/spec/lib/gitlab/email/smime/certificate_spec.rb
@@ -9,7 +9,8 @@ describe Gitlab::Email::Smime::Certificate do
   # so we share them as instance variables in all tests
   before :context do
     @root_ca = generate_root
-    @cert = generate_cert(root_ca: @root_ca)
+    @intermediate_ca = generate_intermediate(signer_ca: @root_ca)
+    @cert = generate_cert(signer_ca: @intermediate_ca)
   end
 
   describe 'testing environment setup' do
@@ -21,11 +22,23 @@ describe Gitlab::Email::Smime::Certificate do
       end
     end
 
+    describe 'generate_intermediate' do
+      subject { @intermediate_ca }
+
+      it 'generates an intermediate CA that expires a long way in the future' do
+        expect(subject[:cert].not_after).to be > 999.years.from_now
+      end
+
+      it 'generates an intermediate CA properly signed by the root CA' do
+        expect(subject[:cert].issuer).to eq(@root_ca[:cert].subject)
+      end
+    end
+
     describe 'generate_cert' do
       subject { @cert }
 
-      it 'generates a cert properly signed by the root CA' do
-        expect(subject[:cert].issuer).to eq(@root_ca[:cert].subject)
+      it 'generates a cert properly signed by the intermediate CA' do
+        expect(subject[:cert].issuer).to eq(@intermediate_ca[:cert].subject)
       end
 
       it 'generates a cert that expires soon' do
@@ -37,7 +50,7 @@ describe Gitlab::Email::Smime::Certificate do
       end
 
       context 'passing in INFINITE_EXPIRY' do
-        subject { generate_cert(root_ca: @root_ca, expires_in: SmimeHelper::INFINITE_EXPIRY) }
+        subject { generate_cert(signer_ca: @intermediate_ca, expires_in: SmimeHelper::INFINITE_EXPIRY) }
 
         it 'generates a cert that expires a long way in the future' do
           expect(subject[:cert].not_after).to be > 999.years.from_now
@@ -50,7 +63,7 @@ describe Gitlab::Email::Smime::Certificate do
     it 'parses correctly a certificate and key' do
       parsed_cert = described_class.from_strings(@cert[:key].to_s, @cert[:cert].to_pem)
 
-      common_cert_tests(parsed_cert, @cert, @root_ca)
+      common_cert_tests(parsed_cert, @cert, @intermediate_ca)
     end
   end
 
@@ -61,17 +74,43 @@ describe Gitlab::Email::Smime::Certificate do
 
       parsed_cert = described_class.from_files('a_key', 'a_cert')
 
-      common_cert_tests(parsed_cert, @cert, @root_ca)
+      common_cert_tests(parsed_cert, @cert, @intermediate_ca)
+    end
+
+    context 'with optional ca_certs' do
+      it 'parses correctly certificate, key and ca_certs' do
+        allow(File).to receive(:read).with('a_key').and_return(@cert[:key].to_s)
+        allow(File).to receive(:read).with('a_cert').and_return(@cert[:cert].to_pem)
+        allow(File).to receive(:read).with('a_ca_cert').and_return(@intermediate_ca[:cert].to_pem)
+
+        parsed_cert = described_class.from_files('a_key', 'a_cert', 'a_ca_cert')
+
+        common_cert_tests(parsed_cert, @cert, @intermediate_ca, with_ca_certs: [@intermediate_ca[:cert]])
+      end
+    end
+  end
+
+  context 'with no intermediate CA' do
+    it 'parses correctly a certificate and key' do
+      cert = generate_cert(signer_ca: @root_ca)
+
+      allow(File).to receive(:read).with('a_key').and_return(cert[:key].to_s)
+      allow(File).to receive(:read).with('a_cert').and_return(cert[:cert].to_pem)
+
+      parsed_cert = described_class.from_files('a_key', 'a_cert')
+
+      common_cert_tests(parsed_cert, cert, @root_ca)
     end
   end
 
-  def common_cert_tests(parsed_cert, cert, root_ca)
+  def common_cert_tests(parsed_cert, cert, signer_ca, with_ca_certs: nil)
     expect(parsed_cert.cert).to be_a(OpenSSL::X509::Certificate)
     expect(parsed_cert.cert.subject).to eq(cert[:cert].subject)
-    expect(parsed_cert.cert.issuer).to eq(root_ca[:cert].subject)
+    expect(parsed_cert.cert.issuer).to eq(signer_ca[:cert].subject)
     expect(parsed_cert.cert.not_before).to eq(cert[:cert].not_before)
     expect(parsed_cert.cert.not_after).to eq(cert[:cert].not_after)
     expect(parsed_cert.cert.extensions).to include(an_object_having_attributes(oid: 'extendedKeyUsage', value: match('E-mail Protection')))
     expect(parsed_cert.key).to be_a(OpenSSL::PKey::RSA)
+    expect(parsed_cert.ca_certs).to match_array(Array.wrap(with_ca_certs)) if with_ca_certs
   end
 end