Develop (#58)

This pull request introduces several important improvements and bug
fixes to the uPKI CA Server, focusing on robust Distinguished Name (DN)
handling, enhanced certificate management APIs, and dependency updates.
The changes ensure compatibility with both slash-separated and RFC 4514
comma-separated DN formats, fix certificate renewal bugs, and add
comprehensive tests for these scenarios. Additionally, the pull request
updates dependencies, removes the obsolete `setup.py`, and increments
the project version.

**Key changes:**

### DN Handling and Certificate Management

* Refactored all certificate management methods in `Authority`
(`revoke_certificate`, `unrevoke_certificate`, `renew_certificate`,
`view_certificate`, and `delete_certificate`) to correctly extract and
use the Common Name (CN) from both slash-separated and RFC 4514
comma-separated Distinguished Names, fixing bugs where certificates
could not be found or renewed if the DN was not in the expected format.
[[1]](diffhunk://#diff-55729ca46f7c8f84c983dc6ce4b678948d538c8771c7037a9db28c021844c773R590-R596)
[[2]](diffhunk://#diff-55729ca46f7c8f84c983dc6ce4b678948d538c8771c7037a9db28c021844c773R653-R656)
[[3]](diffhunk://#diff-55729ca46f7c8f84c983dc6ce4b678948d538c8771c7037a9db28c021844c773L699-R706)
[[4]](diffhunk://#diff-55729ca46f7c8f84c983dc6ce4b678948d538c8771c7037a9db28c021844c773L709-R723)
[[5]](diffhunk://#diff-55729ca46f7c8f84c983dc6ce4b678948d538c8771c7037a9db28c021844c773L775-R784)
[[6]](diffhunk://#diff-55729ca46f7c8f84c983dc6ce4b678948d538c8771c7037a9db28c021844c773R876-R881)
[[7]](diffhunk://#diff-55729ca46f7c8f84c983dc6ce4b678948d538c8771c7037a9db28c021844c773L826-L828)

* Added a new `list_nodes` method to `Authority` to enumerate all
certificates issued by the CA, including those not revoked or renewed,
and expose their revocation status.

### Testing and Regression Coverage

* Introduced comprehensive tests for DN parsing, certificate renewal,
and the new `list_nodes` API, including regression tests for real-world
bugs involving RFC 4514 DNs and renewal failures.
[[1]](diffhunk://#diff-44ccbaf10c5a27481125e68ca0397fbf805936e44266cf4dedda6493515cbd4aR55-R67)
[[2]](diffhunk://#diff-0c03354020754c0ffe5e1c4b723181f6bc057b2e6bb73af9a0a2071055085dccR1709-R1899)

* Updated functional tests to handle variations in OpenSSL subject
formatting across versions using regular expressions.
[[1]](diffhunk://#diff-0c03354020754c0ffe5e1c4b723181f6bc057b2e6bb73af9a0a2071055085dccL198-R200)
[[2]](diffhunk://#diff-0c03354020754c0ffe5e1c4b723181f6bc057b2e6bb73af9a0a2071055085dccL300-R308)
[[3]](diffhunk://#diff-0c03354020754c0ffe5e1c4b723181f6bc057b2e6bb73af9a0a2071055085dccL532-R540)

### Dependency and Build System Updates

* Updated Python dependencies to the latest compatible versions in
`pyproject.toml`, including `cryptography`, `pyzmq`, `tinydb`, `pytest`,
and `ruff`.

* Set the Python version to 3.11.13 in `.python-version`.

* Removed the obsolete `setup.py` file in favor of modern build tooling.

### Versioning

* Bumped the project version to 0.1.5 in `upki_ca/__init__.py`.

### Minor

* Minor import fix in tests to support new test cases.

Author: x42en

.python-version

@@ -0,0 +1 @@
+3.11.13

poetry.lock

@@ -9,25 +9,25 @@ license = {text = "MIT"}
 readme = "README.md"
 requires-python = ">=3.11, <4.0"
 dependencies = [
-    "cryptography (>=46.0.5,<47.0.0)",
+    "cryptography (>=50.0.1,<51.0.0)",
     "pyyaml (>=6.0.3,<7.0.0)",
-    "tinydb (>=4.8.2,<5.0.0)",
-    "pyzmq (>=26.0.0,<27.0.0)"
+    "tinydb (>=4.9.0,<5.0.0)",
+    "pyzmq (>=27.0.0,<28.0.0)"
 ]
 
 [tool.poetry.group.lint]
 optional = true
 
 [tool.poetry.group.lint.dependencies]
-ruff = ">=0.10.0,<1.0.0"
+ruff = ">=0.16.0,<1.0.0"
 
 [tool.poetry.group.dev]
 optional = true
 
 [tool.poetry.group.dev.dependencies]
-pytest = ">=8.0.0,<9.0.0"
-pytest-cov = ">=6.0.0,<7.0.0"
-pytest-asyncio = ">=0.25.0,<1.0.0"
+pytest = ">=9.0.0,<10.0.0"
+pytest-cov = ">=7.0.0,<8.0.0"
+pytest-asyncio = ">=1.0.0,<2.0.0"
 
 [tool.pytest.ini_options]
 testpaths = ["tests"]

pyproject.toml

@@ -52,6 +52,19 @@ def test_parse_dn_without_slashes(self):
         assert result["C"] == "FR"
         assert result["CN"] == "example.com"
 
+    def test_parse_dn_rfc4514_comma_separated(self):
+        """Test DN parsing for the comma-separated RFC 4514 format produced
+        by cryptography's ``Name.rfc4514_string()`` and passed through as-is
+        by the RA's inventory API (real bug found via a Phase 3 live smoke
+        test: revoke/renew/view/unrevoke/delete all silently failed with
+        "Certificate not found" for any real cert, since its DN always has
+        more than just a CN and therefore never contains a "/")."""
+        dn = "CN=example.com,O=Company"
+        result = Common.parse_dn(dn)
+
+        assert result["CN"] == "example.com"
+        assert result["O"] == "Company"
+
     def test_build_dn(self):
         """Test DN building."""
         components = {"C": "FR", "O": "Company", "CN": "example.com"}

setup.py

@@ -14,6 +14,7 @@
 """
 
 import os
+import re
 import shutil
 import subprocess
 import sys
@@ -195,8 +196,8 @@ def test_generate_certificate_with_openssl(self):
             check=True,
         )
         assert "Certificate:" in result.stdout
-        # Note: openssl outputs "CN = Test Entity" with spaces
-        assert "CN =" in result.stdout and "Test Entity" in result.stdout
+        # openssl subject format varies by version ("CN = X" vs "CN=X")
+        assert re.search(r"CN\s*=\s*Test Entity", result.stdout)
 
         # Verify certificate dates
         result = subprocess.run(
@@ -297,14 +298,14 @@ def test_validate_certificate_with_openssl(self):
         assert "Version:" in result.stdout
         assert "Serial Number:" in result.stdout
 
-        # Verify certificate subject - openssl outputs with spaces
+        # Verify certificate subject - openssl subject format varies by version
         result = subprocess.run(
             ["openssl", "x509", "-in", entity_cert, "-noout", "-subject"],
             capture_output=True,
             text=True,
             check=True,
         )
-        assert "CN =" in result.stdout and "Test Entity" in result.stdout
+        assert re.search(r"CN\s*=\s*Test Entity", result.stdout)
 
     def test_certificate_chain_verification(self):
         """
@@ -529,14 +530,14 @@ def test_certificate_creation_for_revocation(self):
         )
         assert "OK" in result.stdout
 
-        # Verify the certificate structure
+        # Verify the certificate structure - openssl subject format varies by version
         result = subprocess.run(
             ["openssl", "x509", "-in", test_cert, "-noout", "-subject"],
             capture_output=True,
             text=True,
             check=True,
         )
-        assert "CN =" in result.stdout and "Revoke Test" in result.stdout
+        assert re.search(r"CN\s*=\s*Revoke Test", result.stdout)
 
 
 # Run tests if executed directly
@@ -1705,6 +1706,197 @@ def test_start_uses_provided_env_seed(self):
         assert written_seed == expected_seed
 
 
+class TestListNodes:
+    """Tests for `Authority.list_nodes()` (backs the CA's `list_nodes` ZMQ task)."""
+
+    @pytest.fixture(autouse=True)
+    def setup_teardown(self):
+        """Set up and tear down for each test."""
+        self.pki_path = "/tmp/test_pki_list_nodes"
+
+        if os.path.exists(self.pki_path):
+            shutil.rmtree(self.pki_path)
+
+        from upki_ca.ca.authority import Authority
+
+        Authority.reset_instance()
+
+        yield
+
+        if os.path.exists(self.pki_path):
+            shutil.rmtree(self.pki_path)
+        Authority.reset_instance()
+
+    def _authority(self):
+        from upki_ca.ca.authority import Authority
+        from upki_ca.storage.file_storage import FileStorage
+
+        storage = FileStorage(self.pki_path)
+        storage.initialize()
+        authority = Authority.get_instance()
+        authority.initialize(storage=storage, keychain=self.pki_path)
+        return authority
+
+    def test_list_nodes_empty_when_nothing_issued(self):
+        authority = self._authority()
+        assert authority.list_nodes() == []
+
+    def test_list_nodes_includes_certificates_issued_via_generate_certificate(self):
+        """Certificates issued via generate_certificate must be listed even if
+        never revoked/renewed (they never touch node storage otherwise)."""
+        authority = self._authority()
+        cert = authority.generate_certificate("node1.example.com", "server")
+
+        nodes = authority.list_nodes()
+        assert len(nodes) == 1
+        assert nodes[0]["cn"] == "node1.example.com"
+        assert nodes[0]["dn"] == "/CN=node1.example.com"
+        assert nodes[0]["serial"] == cert.serial_number
+        assert "BEGIN CERTIFICATE" in nodes[0]["certificate"]
+        assert nodes[0]["revoked"] is False
+
+    def test_list_nodes_includes_certificates_issued_via_sign_csr(self):
+        authority = self._authority()
+
+        from cryptography import x509
+        from cryptography.hazmat.primitives import hashes, serialization
+        from cryptography.hazmat.primitives.asymmetric import rsa
+        from cryptography.x509.oid import NameOID
+
+        private_key = rsa.generate_private_key(public_exponent=65537, key_size=2048)
+        csr = (
+            x509.CertificateSigningRequestBuilder()
+            .subject_name(
+                x509.Name([x509.NameAttribute(NameOID.COMMON_NAME, "csr-node.example.com")])
+            )
+            .sign(private_key, hashes.SHA256())
+        )
+        csr_pem = csr.public_bytes(serialization.Encoding.PEM).decode("utf-8")
+
+        authority.sign_csr(csr_pem, "server")
+
+        nodes = authority.list_nodes()
+        assert len(nodes) == 1
+        assert nodes[0]["cn"] == "csr-node.example.com"
+
+    def test_list_nodes_reflects_revoked_status(self):
+        authority = self._authority()
+        authority.generate_certificate("revoke-me.example.com", "server")
+
+        authority.revoke_certificate("/CN=revoke-me.example.com", "keyCompromise")
+
+        nodes = authority.list_nodes()
+        assert len(nodes) == 1
+        assert nodes[0]["revoked"] is True
+
+    def test_list_nodes_multiple_certificates(self):
+        authority = self._authority()
+        authority.generate_certificate("node1.example.com", "server")
+        authority.generate_certificate("node2.example.com", "server")
+
+        nodes = authority.list_nodes()
+        assert {n["cn"] for n in nodes} == {"node1.example.com", "node2.example.com"}
+
+
+class TestRenewCertificateRFC4514DN:
+    """Tests for `Authority.renew_certificate()` with a comma-separated,
+    multi-attribute RFC 4514 DN (e.g. "CN=x,O=y", as produced by
+    `cryptography`'s `Name.rfc4514_string()` and passed through as-is by the
+    RA's `/api/v1/inventory/certificates/{serial}/renew` endpoint - see
+    `upki_ra/utils/cert_metadata.py`).
+
+    Regression coverage for two real bugs found via a live Phase 3 frontend
+    smoke test (renew always failed for any real certificate):
+    1. `Common.parse_dn()` only understood the CA's native slash-separated
+       format (`/CN=x/O=y`); a comma-separated multi-attribute DN with no
+       slash at all was parsed into a single garbage key/value pair with no
+       "CN" key, so the pre-renewal `storage.get_cert()` lookup always
+       raised "Certificate not found".
+    2. Even past that, `renew_certificate()` extracted the *old*
+       certificate's own CN via a dict keyed by `attr.oid._name`
+       (cryptography's *long* name, e.g. "commonName") then looked up the
+       short form "CN" in it - a key that never existed, so it always
+       raised "Old certificate has no Common Name".
+    """
+
+    @pytest.fixture(autouse=True)
+    def setup_teardown(self):
+        """Set up and tear down for each test."""
+        self.pki_path = "/tmp/test_pki_renew_rfc4514"
+
+        if os.path.exists(self.pki_path):
+            shutil.rmtree(self.pki_path)
+
+        from upki_ca.ca.authority import Authority
+
+        Authority.reset_instance()
+
+        yield
+
+        if os.path.exists(self.pki_path):
+            shutil.rmtree(self.pki_path)
+        Authority.reset_instance()
+
+    def _authority(self):
+        from upki_ca.ca.authority import Authority
+        from upki_ca.storage.file_storage import FileStorage
+
+        storage = FileStorage(self.pki_path)
+        storage.initialize()
+        authority = Authority.get_instance()
+        authority.initialize(storage=storage, keychain=self.pki_path)
+        return authority
+
+    def _sign_csr_with_cn_and_o(self, authority, cn: str, org: str) -> None:
+        from cryptography import x509
+        from cryptography.hazmat.primitives import hashes, serialization
+        from cryptography.hazmat.primitives.asymmetric import rsa
+        from cryptography.x509.oid import NameOID
+
+        private_key = rsa.generate_private_key(public_exponent=65537, key_size=2048)
+        csr = (
+            x509.CertificateSigningRequestBuilder()
+            .subject_name(
+                x509.Name(
+                    [
+                        x509.NameAttribute(NameOID.COMMON_NAME, cn),
+                        x509.NameAttribute(NameOID.ORGANIZATION_NAME, org),
+                    ]
+                )
+            )
+            .sign(private_key, hashes.SHA256())
+        )
+        csr_pem = csr.public_bytes(serialization.Encoding.PEM).decode("utf-8")
+        authority.sign_csr(csr_pem, "server")
+
+    def test_renew_succeeds_with_comma_separated_multi_attribute_dn(self):
+        authority = self._authority()
+        self._sign_csr_with_cn_and_o(authority, "renew-me.example.com", "Test Corp")
+
+        # Same shape/order as `cert.subject.rfc4514_string()` for a
+        # CN-then-O subject (RFC 4514 lists attributes most-specific-first).
+        rfc4514_dn = "CN=renew-me.example.com,O=Test Corp"
+
+        new_cert, new_serial = authority.renew_certificate(rfc4514_dn)
+
+        assert new_cert.subject_cn == "renew-me.example.com"
+        assert new_serial != 0
+
+    def test_renew_succeeds_with_organization_first_dn(self):
+        """Same as above but with O before CN in the DN string - this is the
+        exact ordering that triggered bug #1 above (the pre-fix parser
+        consumed the whole rest of the string as O's value, so no "CN" key
+        was ever produced)."""
+        authority = self._authority()
+        self._sign_csr_with_cn_and_o(authority, "renew-me2.example.com", "Test Corp")
+
+        rfc4514_dn = "O=Test Corp,CN=renew-me2.example.com"
+
+        new_cert, _ = authority.renew_certificate(rfc4514_dn)
+
+        assert new_cert.subject_cn == "renew-me2.example.com"
+
+
 # Run tests if executed directly
 if __name__ == "__main__":
     pytest.main([__file__, "-v"])

tests/test_00_common.py

@@ -13,10 +13,10 @@
 - Profiles: Certificate profile management
 - ZMQ connectors: CA-RA communication
 
-Version: 0.1.0
+Version: 0.1.5
 """
 
-__version__ = "0.1.0"
+__version__ = "0.1.5"
 __author__ = "uPKI Team"
 __license__ = "MIT"